What is the correct way to create and store JWT refresh tokens?

userttib1 0
Viewed 17

I am currently attempting to implement auth into my API and am puzzled by the concept of refresh tokens. I understand they are for generating new access tokens upon their expiration, however I am unsure as to what payload they are meant to carry and how they are meant to be stored in the DB.

Several sources have implemented refresh tokens using the same payload as the access tokens (i.e a userId). Others have implemented a session system whereby a session object is serialized and checked upon validation.

My main confusion regards the validation and invalidation of refresh tokens. Are refresh tokens meant to be stored in the DB alongside the user, such that you can check that it is valid (and not being reused)? If so, should it be deleted from the DB when a new refresh token is generated? If this is the case, how do you allow for multiple sessions across several clients? It seems wasteful to store all past refresh tokens or session objects in the DB, particularly if the expiration time of the access token is short.

Apologies for the somewhat rambling question. This topic is one I'm struggling to get a grip of so any help would be much appreciated.

express-jwt refresh-token jwt authentication
1 Answers

First please understand the importance of JWT token , they are meant to verify the integrity of the user i.e. genuine user.

For this purpose access token are generated and verified at each request to check weather the authentic user is making that request and also these token have expiring time based on your requirement and to refresh them refresh token are used. now lets say your token have very short TTL and you make request to refresh your token with each request of refreshing these token your server has to access DB and refresh the token , if you have store serialized object in token then it would add another business logic to deserialize and check for the Userid.

therefore the you should store minimum information in these token access token as well as refresh token , and this refresh token you should store along side user with minimum information.

Niraj Gautam0
Related