How do refresh tokens work in an OAuth flow?

1
votes

I'm working with the Reddit API, which uses OAuth to authenticate users for the API.

The APIs for their OAuth mention that essentially you present the user with a webpage, and after they grant approval they're redirected back to your application which is given a code. You can then take this code and make a request to the API to be given an access token which you can store.

With the Reddit API specifically you can set a duration, either temporary or permanent. With permanent, it seemingly seems you need to restore a "refresh token" received alongside the above access token, as the access token will expire every hour, and the refresh token will allow you to be granted a new access token.

Am I correct in understanding this? What is the point of the "permanent" request if hourly it expires? Furthermore, how do I track this in an application sense? Do I set a timer for an hour after the initial token to request a new one? What if the app is closed, do I write the last request time to disk, check if it's been more than an hour, and refresh it otherwise?

Am I understanding refresh tokens properly and they have to be managed this... manually?

1
iosapioauthoauth-2.0reddit
You can also use a 'refresh on failure' approach to avoid the complexity of timing at the expense of a little extra network traffic. – Wain

1 Answers

1
votes

Am I correct in understanding this?

  • Yes

What is the point of the "permanent" request if hourly it expires?

  • The User has delegated access to your application. The user could go a revoke access whenever he wants.

Furthermore, how do I track this in an application sense?

You could do a timer or as Wain said, just "refresh on failure".

What if the app is closed, do I write the last request time to disk, check if it's been more than an hour, and refresh it otherwise?

Yes or use the "refresh on failure" approach.