Concepts and Usage of Access Token and Refresh Token for Login in Node.js (Express.js)

user_10866409 0
Viewed 2392

I would like to implement user login using JWT, but there is some confusion.

First, when the user successfully logs in, the server issues an Access Token and a Refresh Token. Then, The server sends the user information (id, name, grade) in the Access Token.

At this time, the Refresh Token is stored in the database along with the userId and is not delivered to the client.

The Access Token has a period of 7 days, and if client return within 3 days, authenticate the user through the existing Access Token.

If access token has been more than 3 days, server uses the user_id to query the Refresh Token stored in the database. At this time, if the Refresh Token is valid, server will try to reissue the 7-day Access Token.

I want to manage users in this way, is this correct?

I think the server should not pass the Refresh Token to the client.

I've read the following, but I do not know how to do it properly. Thank you for your advice.

refresh-token access-token oauth-2.0 node.js
1 Answers

It sounds like you want to implement the full OAuth workflow for authentication. I'd advise you against the complexity unless your application really needs it. For a single API, it's alright if you issue a JWT token and pass it to the consumer, then the application will use this token in the requests and the server will authenticate the token.

However, if your application will be used by numerous devices (browser, mobile, Desktop, even other servers) and assuming you want extra security, then Oauth might pay off. In that case, you should give the refresh tokens to the user, and not auto-renew them. Otherwise, imagine someone steals someone else's (outdated) token... it will get auto-renewed! That person will gain access to the system on behalf of the other person.

I recommend you this package for working with express and Oauth: https://www.npmjs.com/package/express-oauth-server

user_64323980
Related