问题
Each refresh token is valid for 14 days. Why do the refresh tokens expire?
回答1:
14 days was based on what is considered best practice in implementing OAuth2. See Why do access tokens expire? for a pretty comprehensive answer about why OAuth2 refresh tokens expire.
We are interested in hearing what number bigger than 14 would work for your application. We picked 14 days based on initial feedback, surveys from application developers, as well as looking at application logins by users. A high majority of users login with apps more often than every 14 days.
Can you explain your use case? What would be the ideal non-infinite refresh-interval that would give you a balance between peace-of-mind about security, and convenience
来源：https://stackoverflow.com/questions/15564486/why-do-refresh-tokens-expire-after-14-days