Loading…

Refresh Tokens & Secure Session Management in ASP.NET Core · devs3

Account

#dotnet-core #aspdotnet #refresh-token #secure-session

Refresh Tokens & Secure Session Management in ASP.NET Core

By Samim Hossain · March 15, 2026 · 3 min read · 153 views

Authentication doesn’t end after issuing a JWT. Real-world applications must handle token expiration, session continuity, and security threats like token theft.
In this article, we’ll explore Refresh Tokens and how to build secure session management in ASP.NET Core.

Why Refresh Tokens Are Important

JWT access tokens are:

Stateless
Short-lived
Not revocable easily

If access tokens never expire → huge security risk
If they expire too quickly → bad user experience

👉 Refresh tokens solve this problem

Token Strategy (Best Practice)

plaintext

| Token Type    | Lifetime     | Purpose              |
| ------------- | ------------ | -------------------- |
| Access Token  | 5–15 minutes | API authorization    |
| Refresh Token | Days / Weeks | Get new access token |

How Refresh Tokens Work (Flow)

User logs in
Server issues:

Join the conversation

Comments

Add a comment

No comments yet. Start the conversation.

#nginx

🚀 Deploying & Securing ASP.NET Core Applications

3 min read

#nginx

⚙️ Continuous Integration & Continuous Deployment (CI/CD) for ASP.NET Core

3 min read

public class RefreshToken
{
    public int Id { get; set; }
    public string TokenHash { get; set; }
    public DateTime ExpiresAt { get; set; }
    public bool IsRevoked { get; set; }
    public string UserId { get; set; }
}

[HttpPost("login")]
public async Task<IActionResult> Login(LoginDto dto)
{
    // Validate user credentials

    var accessToken = GenerateJwt(user);
    var refreshToken = GenerateRefreshToken();

    SaveRefreshToken(user.Id, HashToken(refreshToken));

    Response.Cookies.Append("refreshToken", refreshToken, new CookieOptions
    {
        HttpOnly = true,
        Secure = true,
        SameSite = SameSiteMode.Strict,
        Expires = DateTime.UtcNow.AddDays(7)
    });

    return Ok(new { accessToken });
}

[HttpPost("refresh")]
public IActionResult Refresh()
{
    var refreshToken = Request.Cookies["refreshToken"];
    if (string.IsNullOrEmpty(refreshToken))
        return Unauthorized();

    var tokenHash = HashToken(refreshToken);
    var storedToken = _db.RefreshTokens.FirstOrDefault(t => t.TokenHash == tokenHash);

    if (storedToken == null || storedToken.IsRevoked || storedToken.ExpiresAt < DateTime.UtcNow)
        return Unauthorized();

    // Rotate token
    storedToken.IsRevoked = true;

    var newRefreshToken = GenerateRefreshToken();
    SaveRefreshToken(storedToken.UserId, HashToken(newRefreshToken));

    var newAccessToken = GenerateJwt(user);

    Response.Cookies.Append("refreshToken", newRefreshToken, cookieOptions);

    return Ok(new { accessToken = newAccessToken });
}

[HttpPost("logout")]
public IActionResult Logout()
{
    var refreshToken = Request.Cookies["refreshToken"];
    RevokeRefreshToken(refreshToken);

    Response.Cookies.Delete("refreshToken");
    return Ok();
}

Refresh Tokens & Secure Session Management in ASP.NET Core

Why Refresh Tokens Are Important

Token Strategy (Best Practice)

How Refresh Tokens Work (Flow)

Join the conversation

Comments

🚀 Deploying & Securing ASP.NET Core Applications

⚙️ Continuous Integration & Continuous Deployment (CI/CD) for ASP.NET Core

Designing a Secure Refresh Token System

🔐 Key Security Principles

Database Model Example

Generating a Secure Refresh Token

Hash Before Storing

Login Endpoint Example

Refresh Token Endpoint

Token Rotation (Highly Recommended)

Why?

Secure Session Management Tips

✅ Best Practices

Logout Implementation

Common Mistakes to Avoid

Real-World Use Cases

Why Refresh Tokens Are Important

Token Strategy (Best Practice)

How Refresh Tokens Work (Flow)

Join the conversation

Comments

Keep reading

🚀 Deploying & Securing ASP.NET Core Applications

⚙️ Continuous Integration & Continuous Deployment (CI/CD) for ASP.NET Core

Designing a Secure Refresh Token System

🔐 Key Security Principles

Database Model Example

Generating a Secure Refresh Token

Hash Before Storing

Login Endpoint Example

Refresh Token Endpoint

Token Rotation (Highly Recommended)

Why?

Secure Session Management Tips

✅ Best Practices

Logout Implementation

Common Mistakes to Avoid

Real-World Use Cases