What is the validity period of the OAuth 2.0 token before it needs to be refreshed?

• A. 5 minutes
• B. 10 minutes
• C. 30 minutes
• D. 1 hour

Answer: (B)

In the context of OAuth 2.0, the validity period of an access token can vary based on the implementation and security requirements of the application. While the answer provided suggests a validity period of 10 minutes, it's important to note that this timeframe is one of the commonly used durations, aiming to strike a balance between security and usability.

A shorter validity period, such as 5 minutes, may increase the frequency of access token refreshes, which could impede user experience but enhances security. On the other hand, a longer validity period, such as 30 minutes or 1 hour, could potentially increase the risk if a token is compromised since it would remain valid for a longer duration.

OAuth 2.0 does not stipulate a standard token lifetime, and the actual duration is defined by best practices and organizational policy tailored to specific applications or services. Therefore, a 10-minute period is a reasonable choice, as it offers a relatively secure timeframe that is commonly adopted in various implementations, reflecting the need to mitigate risks associated with token theft while maintaining a smooth user experience.