security - Store the oauth access_token or ask a new one each 'session' -


i'm playing around api of service supports oauth. managed retrieve access_token service , i'm able call various endpoints of api. far good.

now question is: how long hold on access_token received. token keep forever, or expire after time? i'm working on desktop app, have 2 options:

  • i request new token every time application opened
  • i store token somewhere , re-use it

what best practices around storage of token?

usually access token stored across sessions. there expiration (with oauth 2.0), refresh token used retrieve new access token. if don't store tokens, need have end user re-authorize everytime want use application (which not experience looking for).


Comments

Popular posts from this blog

node.js - Bad Request - node js ajax post -

Why does Ruby on Rails generate add a blank line to the end of a file? -

keyboard - Smiles and long press feature in Android -