2

I understood why Access Tokens have to be expired (here is the topic), but I am a bit confused about the purpose of the expires_in:

  1. expires_in seems to be less useful than a fixed time, since there are delay in network operations and extra computation as well. Why don't we simply use a standard time (like Unix timestamp or ISO 8601)?

  2. As in that topic, if we are assuming Access Tokens are very short-lived, are we going to "bomb" the OAuth2 server with refresh token for every operation?

Luke Vo
  • 14,925
  • 19
  • 92
  • 153

0 Answers0