Should Refresh Tokens Be Revoked When Access Tokens Expire?

Unresolved Spec Decision

OAuth 2.0 RFC 6749 mandates an expiration time for access tokens but does not require a revocation endpoint. JWTs include an "exp" claim that clients must validate, yet the JWT spec offers no revocation mechanism. OpenID Connect extends the model with refresh‑token expiration rules, but the timing of refresh‑token invalidation after user logout is unspecified.

The core question is whether a refresh token should automatically become invalid when its associated access token expires, even if the user remains logged in and the refresh token itself has a longer lifetime.

Key constraints:

• Spec ambiguity around refresh‑token revocation timing.
• Potential security implications of keeping a valid refresh token after access token expiry.
• Variations in provider implementations.

Specific questions:

• Does the OAuth 2.0 specification require that a refresh token be invalidated when its access token expires?
• What best‑practice recommendations exist for OAuth providers handling this scenario?
• Should clients proactively handle refresh‑token revocation upon detecting an expired access token?