title: Why can I still request an access token if refresh token has expired?
body: <p>I have a question related to refresh tokens. I have configured my Angular Client in Identity Server as follows:</p>
  
  <pre><code>RefreshTokenUsage = TokenUsage.OneTimeOnly,
  AccessTokenLifetime = 30,
  AbsoluteRefreshTokenLifetime = 3600,
  RefreshTokenExpiration = TokenExpiration.Sliding,
  SlidingRefreshTokenLifetime = 60,
  </code></pre>
  
  <p>Also, my Angular client uses the 'silent renew' mechanism (using angular-auth-oidc-client).</p>
  
  <p>If the Angular client is started, after 20 seconds the 'silent renew' kicks in and asks for a new access token, which makes sense because this is about 75% of the access token lifetime of 30 seconds). It gets a new access token and all keeps working. </p>
  
  <p>At a given moment in time, I stop the silent renew. This means that it does not refresh the access token anymore, and indeed, after a while my calls to the web api fail because the access token expired.</p>
  
  <p>Now, minutes later I restart 'silent renew'. </p>
  
  <p>The strange thing is that it succeeds in getting a new access token, but it was my understanding that this should not work anymore because the refresh token should have expired after 60 seconds?</p>
  
  <p>I probably misunderstand how this sliding refresh token mechanism works.. can someone explain why I can still request a new access token with a refresh token that has expired?</p>