如果您不使用Google的Oauth流程请求刷新令牌，当access_token过期时会发生什么？

Question

I've been reading Google's oauth docs. Here they talk about requesting a refresh token for "offline access".

https://developers.google.com/accounts/docs/OAuth2WebServer#refresh

I'm curious what happens if you don't request a refresh token and therefore you only have "online" access. But what happens when that access token expires. Do you have to prompt the user to authorize you again? That sounds like a bad experience. Wouldn't you just always want to request a refresh token?

Answer 1

Here is what happens: the flow starts again but depending on the browser/cookies configuration the user wont see this. Internally some redirects happen and google gives you a new access token. Its called 'online' because the user is online (from a browser that did it before). In the 'offline' case you can do the call from anywhere like your backend and not from the user's browser while logged-in.

You also need to be more careful in the offline case, like storing the refresh token in a secure place, and deal with all cases like the user manually revoking the token from https://security.google.com/settings/security/permissions