I have created a C# application connecting to a MYSQL DB via NodeJS API. (all written by myself).
I'm learning this and I'm trying to get the most secure way of organising the Token and Refresh Token.
Currently I just have the API token with no expiry, so I'm implementing:
- 5 min token
- 1 year ref token
My confusion lies with the workflow. Two options I can fathom:
1. Don't use Ref token in header "always":
- Send Token for a request.
- Token Expired - response to app
- App sends refresh token
- check refresh token exists (in mysql)
- check refresh is not expired
- New token created, sent back to app.
- App now sends the token for the initial request.
2. Send ref token in header always:
- Send token and refresh for a request.
- If token expired, check for refresh (error on no refresh)
- check refresh token exists (in mysql)
- check refresh is not expired
- New token created
- run the request using the newly generated token
- return original request response but with the new access token connected
Now the Option 1 seems... like every time there is a new token generation I'm looking at 3 calls to the server. The benefit is that the request doesn't always have that refresh key in it
Option 2 is all based in Node JS, but it means every request response would have something like
{ newTokenCreated: True,
newToken: 123345456567567567,
actualRequestResponse: blahblah }
I'm unsure what is the best way to do this as I have half written the Option 2, but to a degree option 1 seems more appropriate except then every time a token is expired there are then 3 calls just to get the new token from the API, instead of option 2 which is just one call and the app really doesnt have to do that much think, just check if it got given a new access token!
Thanks for any advice. I've watched about 10 youtube videos but can't seem to get this bit down.
