When the refresh token stored in a cookie expires, what happens to the user?

When the refresh token stored in a cookie expires (its validity period ends), the user loses the ability to obtain a new access token through the refresh mechanism.

What happens in practice:

• When attempting to refresh the access token using the expired refresh token, the server rejects the request because the token is invalid.
• The user is considered unauthenticated.
• Usually, the client application redirects the user to the login page for re-authentication.

Thus, expiration of the refresh token requires the user to log in again.

Important:

• The lifespan of the refresh token is usually much longer than that of the access token.
• For security, the refresh token is often stored in an HttpOnly cookie to reduce the risk of theft.
• The server may implement additional mechanisms to revoke the refresh token (for example, upon user logout).