Refresh token
A long-lived credential that an OAuth client exchanges at the token endpoint for new access tokens without involving the user (RFC 6749). Because it outlives sessions, store it securely; for public clients RFC 9700 requires sender-constrained refresh tokens or rotation that detects reuse.
Covered in
Defend OAuth and OIDC against redirect and token attacks
Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.
OAuth 2.0 and OpenID Connect login: authorization code with PKCE
Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.
Defend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
Practice: JWT verification lab: Verify a JWT before trusting it · OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE