I'm building an authentication system that I want to be secure. I plan on using JWT tokens as the main authentication mechanism. When the token expires, the server will return a "401 unauthorized" response, and I would like the client to be able to perform a silent refresh. Typically this is done using a refresh token. I was wondering what the security implications would be of using the user's password hash as the refresh token?
In addition to doing this, I was planning to include the password hash within the JWT. When the JWT is verified, my app will check that the password hash in the JWT matches the user's current password hash. If they are different, the server will tell the client to log the user out.
Are there any security flaws in this process that I'm missing?