I am making a react application and using JWT for authentication. As soon as a user logs in I issue a access token and set a http only cookie named jwt and value is refresh token. As per some articles I have read online it is suggested that access token have a short validity and refresh token have a long validity, so I set validity of access token to be 1 day and refresh token to be 25 days, (numbers are not very relevant). Now as soon as refresh token expires The user is automatically logged out.
Now the app I am developing is a data entry dashboard and I do not want the user to suddenly logout after entering a lot of data even if that happens once a month, so I want to know the industry standard to manage this kind of situation
There is a way to update refresh token without login-password pair:
It is as safe as your flow because when a client gets logged out it understands that someone else already used its refresh token once. So it has to authenticate using username:password and invalidate the last refresh token.