2018/12/18

[taxio]

前回 #10

[taxio]

Refresh Tokenをどう使うか？

• https://auth0.com/blog/jp-refresh-tokens-what-are-they-and-when-to-use-them/
• https://github.com/adam-hanna/goLang-jwt-auth-example

tokenの生成方法はjwtと同じ？ それをどうセキュアに扱うかはフロントの実装依存？？

[taxio]

次回 #12

[taxio]

https://auth0.com/learn/refresh-tokens/

Refresh Tokens are long-lived. This means when a client gets one from a server, this token must be stored securely to keep it from being used by potential attackers, for this reason, it is not safe to store them in the browser. If a Refresh Token is leaked, it may be used to obtain new Access Tokens (and access protected resources) until it is blacklisted. Refresh Tokens must be issued to a single authenticated client to prevent the use of leaked tokens by other parties. Access Tokens must also be kept secret, but due to its shorter life, security considerations are less critical.

やっぱりセキュアにするためにRefresh Tokenの生成アルゴリズムを変えるみたいなことは書いてないな... いかにTokenを守るかって感じ．

[taxio]

Auth0が提供してるIDaaSのRefresh Token． https://auth0.com/docs/tokens/refresh-token/current

あとで読む