Oauth 2.0 refresh token expiration

Question

I am trying to use Oauth2 system for Android development, but I cannot understand what I have to do if refresh token will be expired. Should I show the login form if the refresh token is outdated, if so at what point do I need to check on a token expired?

UPDATE:

My actions: server config: refresh token lifetime 14 days

1.First I try to make a request to the server but the server returns that the access token is expired

2.Then I try to update access token using the refresh token but the server also returns that refresh token is expired

3.Not having received the token, I ask the user to log in again

Is it right?

Library I use link

Please help me understand after refresh token expired actions.

One strategy should be, use access token until it gets expired, after that, use refresh token to get the new access token, if you get new access token, you are good to go else make a new request for a brand new access token & refresh token. — Pratik Shah

Frédéric Frédéric · Accepted Answer · 2015-08-14T22:54:41

Yes you're right ! When your access token and refresh token are expired the only way to get a new token pair is to ask the user for its credentials (you can prompt the user in a login form).

The strategy I use to avoid asking the user for its credetial many time, is to send a new refresh token every time I need to renew the access token.

So when I ask for a new access token my Oauth2 server sends me a new access token and a new refresh token (and the new refresh token expiration date is consequently later]

Oauth 2.0 refresh token expiration

2 Answers