security - Store the oauth access_token or ask a new one each 'session' -
i'm playing around api of service supports oauth. managed retrieve access_token service , i'm able call various endpoints of api. far good.
now question is: how long hold on access_token received. token keep forever, or expire after time? i'm working on desktop app, have 2 options:
- i request new token every time application opened
- i store token somewhere , re-use it
what best practices around storage of token?
usually access token stored across sessions. there expiration (with oauth 2.0), refresh token used retrieve new access token. if don't store tokens, need have end user re-authorize everytime want use application (which not experience looking for).
Comments
Post a Comment