Study. uk . com
  1. Home
  2. All questions
  3. Question 351

CISSP study material · question 351 of 500

Which two statements about OAuth 2.0 refresh tokens match RFC 6749? Choose two.

  1. They must be issued whenever the access token lifetime is under one hour.
  2. They obtain new access tokens at the same scope or narrower, never wider.
  3. Whether one is issued at all is at the authorization server's discretion.
  4. They may be presented directly to the resource server in place of an access token.
Show the answer

Answer: C. Whether one is issued at all is at the authorization server's discretion.
B. They obtain new access tokens at the same scope or narrower, never wider.

Refresh tokens obtain new access tokens with identical or narrower scope when the current one expires, and issuing a refresh token is optional at the authorization server's discretion.

Source: RFC 6749 (IETF) — RFC 6749 > 1.5 Refresh Token

Challenge yourself on this topic → Study as cards