The refresh token is key to separating concerns of the protected resource from the auth server.
I think this is succinctly explained the original rationale (refresh token = refresh secret): http://wiki.oauth.net/ScalableOAuth#Appendix On Jul 8, 2010, at 1:51 AM, Laurens Van Houtven wrote: > Just pitching in as someone writing something that might want a > refresh token but *really* doesn't understand why he'd need them. They > make very little sense to me; why not just make the token that allows > you to access a protected resource last longer? Use case: we've got > protected resources that get updated regularly, and authorizations to > read from it are always long-term (generally indefinitely). > > Not that my vote carries much weight, but I'm definitely in favor of > simply dropping refresh tokens. > > cheers > Laurens > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth > _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
