Would this be a good question if moved here: Token-based authentication using access and refresh tokens

Question

Token-based authentication using access and refresh tokens

A brief summery:

1. Is this approach secure? Specifically:
   • Is sending the username and password through JSON safe if done over HTTPS? How would I prevent unauthorized domains from making calls to this endpoint? Furthermore, how would I prevent programmatic logins?
   • Should the refresh tokens be hashed before storing them in the database, or am I just being paranoid?
2. If the client were a web browser, how would I securely store the refresh token on the client?

You guys handle security questions far better than Software Engineering does but I didn't want to dump it on you if I'm misjudging how it would fit here.

Answer 1

In principle, yes, that type of question would be welcome here, but with one slight change. Asking if it is "secure" is very difficult to answer unless we know "secure against what"

So if the question could be edited to indicate the required use case, we could definitely answer it.