If I understand best practices, JWT usually has an expiration date that is short-lived (~ 15 minutes). So if I don't want my user to log in every 15 minutes, I should refresh my token every 15 minutes.
I need to maintain a valid session for 7 days (UX point of view), so I have two solutions:
- use long-lived json web token (1 week)--bad practice?
- getting a new json web token after the old one expires (JWT 15min, refresh allowed during 1 week)
I'm forcing the use of HTTPS.
The JWT standard doesn't speak about refreshing tokens. Is refreshing an expired token a good strategy?