I have a koajs based nodejs backend for my personal/hobby app. I implemented session handling with jwt tokens. Now the client gets his token after a successful login authentication so my angularjs client stores the token somewhere (currently in sessionStorage but for this question we doesn't care about the storage). I have two questions
When I need to update the user record which the jwt represents, say, the user turned on 2FA so I asked him to provide his phone number and I'd like to set this phone number in the user's record. Currently, after a successful verification on the phone number I call my backend to update the user record and I create a new JWT token with the updated user record (I exclude sensitive information from the jwt token like the hashed pwd and others.., but I'd like to include the phone number for client side usage). So, basically the question is, is it okay to create a new token when some of the credentials change and update the existing client side token with this new token? Should I never-ever create another token, only to create the one and only upon successful authentication? How to I update then the payload in the token?
How should I handle expired jwt tokens? In my mind I have 3 (possible) scenarios:
The jwt is set to short living, say 15minutes. If the backend server replies with a 401 Unauthenticated 'ivalid token' (I guess this is the default behavior of koa-jwt) then I automatically log-out my client and require re-authentication. But I also set up a complementary middleware which is the last in the chain on the backend to re-create the token with a refreshed expiry and the client would also replace the existing token with the refreshed one. So if the user is active and uses the application every protected api call, in case of success, would create a new token to replace the old token.
The jwt is set long-living, say 1 week, and if it expires I opt-in re-authentication from the client.
Copy https://tools.ietf.org/html/rfc6749#section-1.5. Here when creating the jwt token after a successful authentication we send an access_token as well as a refresh_token. When the access_token is expired and the server responds with HTTP 401 'invalid token' (koa-jwt default) then the client sends the refresh_token to the backed to require a new access_token (& optionally a new refresh_token). In this case I don't fully understand how the refresh_token is verified against the old access_token to provide a new token? Or why do we need to have a refresh_token?
Basically I just need generic advice on the upper topics (jwt updates and jwt expiration). Thanks