0
461
ViewsNeed help in understanding refresh tokens, where and how to store them as well as what to store in them
Like the title says, I'm having trouble understanding refresh tokens. How should I make them? the same way as an access token with the package 'jsonwebtoken'? or a different package? if the same package, what do I store in them? the same thing I store in my access token? and should I store my refresh token the same place where I store my access token? How does refresh token make jwt more secure?
I can't find clear answers in the internet since most online tutorials focus more on the access tokens or how secure jwt is without properly explaining refresh tokens. I'm using express by the way.
1 answers
Answer question0
Yes, the refresh tokens work the same as access tokens, they use the same technologies.
A refresh token is a special kind of token used to obtain a renewed access token , the refresh token never expires.
-refresh token is a way to communicate with the Authorization server
-access token is a way to communicate with the Resource server
Check this graph may help you understand the flow :
