Answer
Best practices:
- Store refresh tokens securely
- Use rotating refresh tokens
- Issue short-lived access tokens
- Revoke tokens on suspicious activity
Quick Answer
Refresh tokens securely: store server-side as hashed values (never plaintext) in DB/Redis. Issue new access token + new refresh token on each refresh (rotation). Invalidate old refresh token after rotation. Detect reuse: if a rotated token is presented again, revoke all tokens for that user (indicates theft). Set refresh token expiry (7-30 days). Store in HttpOnly cookie or secure storage (not localStorage).
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ