Spring Boot Tutorial 0/110 lessons ~6 min read Lesson 42
Refresh Tokens
Access tokens are short-lived (15–60 min).
Course progress0%
Focus
3 guided sections
Practice signal
Examples included
Career prep
Foundation builder
Introduction
Access tokens are short-lived (15–60 min). When they expire, the client uses a longer-lived refresh token to mint a new access token without re-prompting for credentials.
Syntax reference
The flow:
bash
Client Auth Service API│ POST /login (email,pw) │ │├────────────────────────►│ ││ access(15m)+refresh(7d)│ ││◄────────────────────────┤ ││ ││ Authorization: Bearer <access> │├───────────────────────────────────────────────────►││ 200 OK││ ││ ... 16 minutes later, access expired ... ││ ││ POST /refresh (refresh_token) │├────────────────────────►│ ││ new access + (rotated) │ ││◄──refresh───────────────┤ │
Best practices
- Store refresh tokens hashed in DB; rotate on every use; revoke on logout.
- Detect re-use of an old refresh token → invalidate the whole family (theft signal).
- httpOnly + Secure + SameSite=strict cookies > localStorage every time.
Ready to mark this lesson complete?Track your journey across the entire course.