How does the reauthentication policy affect refresh tokens?

[kazuki_hirano]

In the reference [https://developers.google.com/identity/protocols/oauth2#expiration], it states 'the session length set by the admin could have been exceeded.' I have set this to 16 hours, but I am still able to use the same refresh token even after several days have passed. What does 'session' refer to in this context? I would like to have a clear indicator of how long I can use this refresh token. By the way, I am using the token obtained through this authentication for SMTP relay from my system's Postfix to Gmail server. 

[Willbin]

Hello @kazuki_hirano,

Welcome to Google Cloud Community!

The "session" mentioned in the OAuth2 documentation regarding refresh token expiration can be confusing, especially when applied to different implementations. While the specified session length in your case is 16 hours, the actual behavior you're experiencing with your refresh token might differ due to several factors.

Clarifying "Session" in OAuth2:

In the general OAuth2 context, the "session" often refers to the user's authenticated state on the authorization server. This session has a defined lifetime (like your 16-hour setting), after which the user needs to re-authenticate to obtain a new access token. However, this session length doesn't directly dictate the refresh token's validity.

Refresh Token Lifetime:

The lifespan of a refresh token is primarily determined by the authorization server's configuration. While some servers might link it to the session length, others treat it as independent, often with longer validity periods (days, weeks, or even indefinite). In your case, the refresh token seems to have a longer lifetime than the 16-hour session, allowing you to use it even after days.

See this link

Thanks!

[kazuki_hirano]

Thank you, Willbin-san.

I regret that I cannot control the expiration of the session. I thought about avoiding unexpected session expiration by regularly refreshing the refresh token and having Postfix reload it. It's not a perfect method, but I believe it's the best solution I can come up with.

Thank you for your response.