If I generate refresh tokens with expire time of 14 days, do I have to store them in my database and compare them when an access token is renewed, or verifying them (with jwt library) is enough?
Also, does it make sense to generate new refresh tokens for the users when they attempt to obtain a new access token?

1 Answer 1


The idea behind cryptographically singed tokens is that you can pass them through untrusted parties and still trust their content as long as the signature is valid and the private key has not been compromised.

If your refresh token contains all the information needed to issue a new access token and the signature is valid (meaning no one has modified the token content) you can trust the token.

The only reason why you would want to store some parts of the refresh token is so you can check if the token has been revoked. Revocation is a bit more difficult with stateless tokens because the token itself stays valid even though you want to revoke it. Usually you would want to store a „user must reauthenticate“ bit in the database and check that if your issue a new access token with a valid refresh token.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .