A refresh token is a special type of access key used to automatically renew a user session without the need to log in again. It is used together with an access token. It is used to ensure user convenience, as it means that users do not have to constantly log in to the application.

The following properties define the lifetime of tokens:

higson.studio.security.token.generation.access-token-lifetime.unit=Minutes
higson.studio.security.token.generation.access-token-lifetime.value=5
higson.studio.security.token.generation.refresh-token-lifetime.unit=Minutes
higson.studio.security.token.generation.refresh-token-lifetime.value=7

The refresh token has a longer lifespan and is used to obtain a new access token. The access token is included in requests and enables authorized access to the API. Once the access token expires, the browser automatically uses the refresh token to retrieve a new access token. If the refresh token also expires, the user will be logged out of the system. Modifying the access token lifetime affects how often it needs to be refreshed — in other words, how frequently the system must generate a new access token. Meanwhile, the refresh token lifetime determines how long a user can remain logged in, that is, how long they can obtain new access tokens without having to log in again.

It’s important to remember that when an automatic logout occurs, any unsaved changes will be lost.