I have a stateless webapp that uses a JWT token. Eventually it will expire - which is OK, but I don't want it to expire while the user is working. Instead, I would like the token to expire after a certain time of inactivity.
Let's say my token is valid 60 minutes, Is it ok to send a new JWT on every request ? That way, as long as the user is working, his token will be renewed (as long as he makes a request per hour), but after more than an hour of inactivity, the token will expire.
I don't want to use stateful refresh tokens. A timer on the client's side would eventually delete the token as soon as it expires.
Am I missing a major flaw with this approach ? (except obvious performance impacts due to more frequent DB accesses)