I am facing a problem in a JWT scenario. When a user logs into the system through a web app, I generate a JWT access token (JWT auth) and a custom refresh token and save the refresh token in DB for later verification. But the problem is that when the same user logs in through the mobile app, it replaces the new refresh token in DB which invalidates the previous refresh token stored in the web's local storage. I want to know how to deal with this problem. Do I need to create a separate table in DB for user refresh tokens and check them out or is there another better approach?
1 Answers
The best approach is to save more than one refresh token per user in a separate table with a foreign key to the user. That way you can have many refresh tokens associated with a user (and also other information about each refresh token, such as an expiry date) that can also help when implementing revocation (you'll have more information to present the user when choosing which token to revoke).
Related