4

I understood why Access Tokens have to be expired (here is the topic), but I am a bit confused about the purpose of the expires_in:

  1. expires_in seems to be less useful than a fixed time, since there are delay in network operations and extra computation as well. Why don't we simply use a standard time (like Unix timestamp or ISO 8601)?

  2. As in that topic, if we are assuming Access Tokens are very short-lived, are we going to "bomb" the OAuth2 server with refresh token for every operation?

Luke Vo
  • 17,859
  • 21
  • 105
  • 181

0 Answers0