Refresh Token
A long-lived credential in the OAuth flow used to silently obtain a new access token after the current one expires. It is usually stored in a server-side database.
Timeline (last 90 days)
In Microsoft 365 scenarios, the default maximum lifetime of a refresh token can be up to 90 days.
A victim changing their password cannot terminate a Device Code attack intrusion; all related tokens must be actively revoked.
In enterprise access scenarios, tokens are often used in conjunction with refresh tokens, and their validity can extend to hours or even days.
Using Access Tokens with very short TTLs (e.g., 5 minutes) paired with Refresh Tokens is currently the more widely adopted compromise in the industry.
Shortening token validity periods, introducing token revocation lists, or using short-lived Access Tokens paired with a Refresh Token mechanism are all common approaches to mitigating the phantom permissions problem.
The agent exchanges the authorization code for an access token at the token endpoint, and after the token expires, it can use a Refresh Token to obtain a new access token without requiring the user to authorize again.
In long-running training jobs, a user's original token may expire before the job completes, requiring the design of token refresh and renewal mechanisms.
All Facts (8)
OAuth是一种授权框架，通过颁发短期有效的Access Token和用于续期的Refresh Token来允许第三方应用在不暴露用户密码的前提下获得有限访问权限
95%UnverifiedA victim changing their password cannot terminate a Device Code attack intrusion; all related tokens must be actively revoked.
50%UnverifiedIn Microsoft 365 scenarios, the default maximum lifetime of a refresh token can be up to 90 days.
50%UnverifiedIn enterprise access scenarios, tokens are often used in conjunction with refresh tokens, and their validity can extend to hours or even days.
50%UnverifiedShortening token validity periods, introducing token revocation lists, or using short-lived Access Tokens paired with a Refresh Token mechanism are all common approaches to mitigating the phantom permissions problem.
50%UnverifiedUsing Access Tokens with very short TTLs (e.g., 5 minutes) paired with Refresh Tokens is currently the more widely adopted compromise in the industry.
50%UnverifiedThe agent exchanges the authorization code for an access token at the token endpoint, and after the token expires, it can use a Refresh Token to obtain a new access token without requiring the user to authorize again.
50%UnverifiedIn long-running training jobs, a user's original token may expire before the job completes, requiring the design of token refresh and renewal mechanisms.
50%