Explain what an refresh token is in an authorization system and how it works.

A refresh token is a special token used to obtain a new access token after the previous one has expired. In authorization systems, such as those using OAuth 2.0, the access token has a limited lifespan (for example, 15 minutes) to enhance security.

When the access token expires, the client sends the refresh token to the authorization server to get a new access token without needing to re-enter login credentials. The refresh token usually has a longer validity period and is stored securely.

Example workflow:

1. The user logs in and receives an access token and a refresh token.
2. The access token is used to access protected resources.
3. When the access token expires, the client sends the refresh token to the server.
4. The server verifies the refresh token and, if valid, issues a new access token.

This increases security and convenience, as it eliminates the need to constantly re-enter login details.