JWT Refresh tokens explained

Here is a summary on what is the purpose of using JWT refresh tokens, how they are generated and used in micro-services oriented architectures. We will also discuss the security implications of storing JWT, and how they can be implemented inside of REST APIs.

Support on Patreon:

----------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------

[dobromirbrezoev]

Can you explain some details about the "start of countdown: from point 5. If my client is say some javascript does this mean I just start a setTimeout function with value equal to the jwt token expiry seconds? Or is there any other technique for issuing this silent refresh? The second solution I can think of is somehow if you try to make a request with an expired jwt token, then the actual silent refresh is issued, but is there any security issues with this approach? Please explain about the countdown.

[nacholopez]

why do you need to persist data in the auth server instead of trusting in jwt signature ?

[codaq]

So if I am using Google Auth for this my server side token logic is handled by Google right?

[sagar]

how to manage refresh_tokens for multiple devices of same user ?

[yuliarahma]

can you plis make tutorial for laravel 8 for role and permissions, thanks

[RedstoneHair]

Do I really need to save the refresh tokens? Can't I just verify the token on the backend and if it's expired or not the same user ID then cancel the refresh and log out?

[Mal-nfsp]

So basically the refresh token is a regular token that requires a lookup on a database every time and the access token is a JWT that never requires a database lookup right?

[mtvmango]

Doesn't it defeat the purpose of the TTL of the secured token

[mahmodsamir]

So what is the purpose of access token ? why not use refresh token directly