如何在浏览器上存储Laravel护照令牌以及如何以及何时发送刷新令牌

Question

I am using laravel passport to generate access token and refresh token.
How and when to check if token is expired and how to request for new token?

Answer 1

If you have a JavaScript application, you should probably use the OAuth2 Implicit flow which gives you an access token and its expiration time. So don't use the Autorization Code Grant flow which works with refresh tokens - it requires a client secret which you cannot keep safe in a browser.

When you get an access token, schedule its refresh using window.setTimeout() . You could refresh it without user interaction using the request parameter prompt=none (see OpenID Connect RFC ). If the token gets invalidated before its regular timeout, you will get an "HTTP 401 Unauthorized" response from a backend. In such case, check the token validity and get a new one if necessary.

It's not a good idea to have the access token as a cookie, because it gets attached to every request (with the same domain, port and possibly path), which may be a security problem. Keep it in sessionStorage .