Simon Frey is a user on chaos.social. You can follow them or interact with them if you have an account anywhere in the fediverse.
What is the sense oft having 2 tokens with #oauth? I have one real one, with that I do my requests and a second "refresh" token for when the first one expires. Why does it need to expire at all?
@l1am0 IIRC the refresh token only works once and you get a new refresh token with the new access token. So every time you renew your token you basically say "Hey, remember me? I've been here before and last time you geave me this *holds up refresh token*".
In some sense you build a trust chain back to the time you presented your real password once.
@l1am0 if it doesn’t expire, there’s not much difference to a password. But with tokens you limit the time someone can do nasty stuff, in case of a leak. And the refresh token also saves you from sending your real (and valid for a long time) password too often.