· Iren Saltali · security
How to Handle Refresh Tokens at the Edge
A pragmatic look at what the gateway should own in refresh flows and what still belongs to the application.
A pragmatic look at what the gateway should own in refresh flows and what still belongs to the application.
A practical look at what a browser-facing API should validate and shape at the edge before requests reach origin code.
How to move Auth0 callback, userinfo, and refresh-token handling into the gateway instead of duplicating the flow in each backend.