// GLOSSARY

Refresh Token

A long-lived credential used to obtain a new access token when the current one expires, without forcing the user to re-authenticate. It strikes a balance in modern identity architecture: access tokens are deliberately short-lived, so that even if stolen they lapse quickly; the refresh token removes the constant re-login burden this short life creates. But this convenience carries a risk, and the risk is precisely in its long life. When a refresh token is seized, the attacker can use it to keep producing new access tokens; a single theft thus becomes durable access. Moreover, a user changing their password often does not invalidate existing refresh tokens on its own, which can render the most common defensive reflex ineffective. These traits make the refresh token a far more valuable target for the attacker than the access token. In session and identity security assessments the critical questions are whether the revocation mechanism actually works, whether rotation is applied, and whether a leak can be detected.