英文:
Microsoft Identity Platform: what happens when refresh token expires?
问题
刷新令牌将在 24 小时内过期,通过初始刷新令牌获取的额外刷新令牌将保留相同的过期时间,因此应用程序必须准备好每 24 小时重新运行授权代码流,以通过交互式身份验证获取新的刷新令牌。
这是否意味着用户必须重新插入凭据?
用户无需输入凭据,通常甚至看不到任何相关的用户体验,只需重新加载应用程序。
但是,浏览器必须在顶级框架中访问登录页面以显示登录会话。
英文:
I read this documentation that says that the refresh token will expire in 24 hours for single page applications, but I don't understand if making a refresh token call to the apis retrieves a new refresh token that I can still use or instead I have to prompt the user to login again (I don't fully understand what the blue box says).
> Additional refresh tokens acquired using the initial refresh token carry over that expiration time, so apps must be prepared to rerun the authorization code flow using an interactive authentication to get a new refresh token every 24 hours
Does this mean the user must insert credentials again?
> Users don't have to enter their credentials and usually don't even see any related user experience, just a reload of your application
It looks like he doesn't have to.
> The browser must visit the log-in page in a top-level frame to show the login session
But this part looks like has to...
答案1
得分: 0
我找到了这个链接,解答了我的问题。
> 针对单页应用程序提供的刷新令牌是有时间限制的(通常为从检索时起的24小时)。这是一个不可调整的、非滑动窗口的生命周期。每当使用刷新令牌更新访问令牌时,将使用新的刷新令牌获取已更新的访问令牌。此新刷新令牌的生命周期将等于原始刷新令牌的剩余生命周期。一旦刷新令牌过期,必须启动新的授权代码流程以检索授权代码并用它交换获取新的令牌集。
注意:当获取新的刷新令牌时,msal.js会用新的刷新令牌替换缓存的刷新令牌,但是服务器不会使旧的刷新令牌失效,直到它过期仍可用于获取访问令牌。
英文:
I found this link that answers my questions
> Refresh tokens given to Single-Page Applications are limited-time refresh tokens (usually 24 hours from the time of retrieval). This is a non-adjustable, non-sliding window, lifetime. Whenever a refresh token is used to renew an access token, a new refresh token is fetched with the renewed access token. This new refresh token will have a lifetime equal to the remaining lifetime of the original refresh token. Once a refresh token has expired, a new authorization code flow must be initiated to retrieve an authorization code and trade it for a new set of tokens.
Note: When a new refresh token is obtained, msal.js replaces the cached refresh token with the new refresh token, however the old refresh token is not invalidated by the server and may still be used to obtain access tokens until its expiration.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。



评论