Expiring Client Secret affects the refresh token?

Question

Once my client secret expired, this will affect my refresh tokens created with my old client secret?
If I created a new refresh token one hour before my client secret expires. Considering a refresh token has a 24 hour lifetime, I will be able to continue creating new access token with this refresh token? Or I need to rotate this refresh token now using my new client secret?

I don't found any similar question but this stackoverflow post

Answer 1

@Oscar Espinosa Thank you for reaching out to us, regarding your requirement, discussed with my team and below is the explanation for your issue.

I am assuming that you are using Single Page application (SPA) which has 24-hour lifetime of refresh token.

As you already have the valid Refresh token before the expiration of client secret, that refresh token is valid until you sign out from the application.

Every time, your session is about to expire, refresh tokens acquired using the initial refresh token carry over that expiration time and the app silently acquires the new access token and refresh token every 24 hours (in this scenario) from application cache.

Users don't have to enter their credentials and usually don't even see any related user experience till they have valid refresh token in the application cache. You won't require to get the new refresh token from new client secret till you have valid refresh token.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens#token-lifetime:~:text=or%20application%20credentials.-,Important,-Refresh%20tokens%20sent

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.