New answers tagged

3

how do we keep the user authenticated on the mobile app even after the refresh token expires? All the famous apps out there do not prompt the user to authenticate let's say weekly or worst daily [...] This use case is the sole purpose of refresh tokens. So set the expiry to match how long you want the user to be able to stay signed in without being prompted ...


5

There is no "ideal" here - it all depends on what you need. While focused on more modern technology, the core of your question is no different from ASP.Net's classic impersionation feature as opposed to using a service account. The same considerations that applied then also apply here now. If the data accessed in B is sensitive to who's asking (i.e....


Top 50 recent answers are included