FrontendHaltSecurity·Intermediate·Conceptual·1 min read
Why do token-based systems use short-lived access tokens with a refresh token?
Short interview answer
A short expiry limits the damage window if an access token leaks, while a longer-lived refresh token, often stored more securely, lets the client obtain new access tokens without forcing the user to log in repeatedly.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.