If I generate refresh tokens with expire time of 14 days, do I have to store them in my database and compare them when an access token is renewed, or verifying them (with jwt library) is enough?
Also, does it make sense to generate new refresh tokens for the users when they attempt to obtain a new access token?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.