Expiry, refresh, and revocation
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
compare sessions and tokens on lifetime and revocation.
Planned topics
- Stateless tokens need no server storage, but cannot be taken back before they expire.
- So use short-lived access tokens (minutes) and, when needed, a refresh token to get new ones.
- A refresh token is long-lived, so store it carefully and make it revocable (kept server side) and rotate it on use.
- Sessions revoke instantly but need server state; tokens scale easily but revocation is harder.
- Logout on a stateless token usually means "forget it on the client" plus a short lifetime.
Draft outline details
Demonstration
a comparison table: sessions vs tokens: state, revocation, scaling, typical lifetime.
Check your understanding
Why make access tokens short-lived?
Show answer
A stolen token stops working soon, since it cannot be revoked easily.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.