JWT access/refresh token claims

Issue #8 new
Nov Matake created an issue

Is the sentence below suggesting refresh token's audience SHOULD be resource servers instead of authorization server? How to distinguish access tokens from refresh tokens?

Current trend seems defining "typ" for each token types, but at least, there should be some guidance to distinguish those two token types.

"Refresh tokens SHOULD be signed with JWS using the same public key and contain the same set of claims as the access tokens."
ref.) http://openid.net/specs/openid-heart-oauth2-1_0-2017-05-31.html#rfc.section.3.2

Comments (1)

  1. Log in to comment