How deeply does ASP.NET Core in Action, 3e cover refresh token?

Defines the exchange and security risk, but does not descend into implementation code.

Refresh token

As explained in ASP.NET Core in Action, 3e

A refresh token is a credential that allows a client to obtain a new access token after the current access token expires without requiring the user to authenticate again.

A refresh token lets a client obtain a new access token after the current one expires, without asking the user to authenticate again. section 25.2

A typical refresh-token flow works like this:

The client uses a short-lived access token to call an API. section 25.2
When the access token expires, the client sends the refresh token to the identity provider. section 25.2
The identity provider returns a new access token, avoiding another user login. section 25.2

A five-minute access token

If an access token expires after five minutes, repeatedly asking the user to log in would create a poor experience. A refresh token allows the client to obtain another access token instead. section 25.2

Protect refresh tokens carefully: anyone who obtains one effectively has the power to impersonate the user by obtaining valid access tokens. section 25.2

How ASP.NET Core in Action, 3e covers it

liveBook manning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Spring in Action, Sixth EditionA refresh token is a credential that a client presents to an authorization server to obtain a new access token after the current one expires.
liveBook manning.com

Software Security for DevelopersA refresh token is a credential that a client presents to an authorization server to obtain a new access token without repeating the user authorization interaction.

Compare how 3 books explain refresh token →

Related concepts

API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
clientused by · A client is a person, organization, device, or software component that receives or uses a product, service, resource, or functionality provided by another entity.
scopeconfigured by · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
Proof Key for Code Exchangeaddressed by · Proof Key for Code Exchange (PKCE) is an OAuth security extension in which a client proves possession of a per-request secret when exchanging an authorization code.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.