title: OAuth2 & Mobile devices - how to persist a long user session?
body: <p>Mobile devices <a href="https://www.rfc-editor.org/rfc/rfc6749#section-2.1" rel="nofollow noreferrer">aren't considered</a> a confidential client, meaning it cannot store secrets. In the OAuth2 case, it means that refresh token and consumer secret should not be stored on the device. Hence, once the access token is expired it's impossible to refresh it and the user is requested to login again.</p>
  <p>Is there a way to persist a long user session other then generating a long-lived access token? Isn't it <a href="https://stackoverflow.com/a/7035926/1111215">bad practice</a> to have a long-lived access token in the first place?</p>