data">





















<h1>Refreshing a Token using Code Flow (not Implicit Flow!)</h1>
<p>When using code flow, you can get an <code>refresh_token</code>. While the original standard DOES NOT allow this for SPAs, the mentioned <a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13">OAuth 2.0 Security Best Current Practice</a> document proposes to ease this limitation. However, it specifies a list of requirements one should take care about before using <code>refresh_tokens</code>. Ple