In most examples I’ve read, I see people mentioning that when the server returns a 401 the client should hit the jwt refresh endpoint, passing in the refresh token somehow (i.e as a cookie), and then continuing on from there with the new JWT token.

I’m failing to see why this can’t just happen automatically on the server side when the server fails to validate (or receive) an expired JWT, assuming it has the refresh token. Is there some security downside that I’m missing?

This assumes that it’s okay to send the refresh token in every request. Assuming HTTPS is in use and the token is stored and sent as a cookie would this raise any issues?

  • Ask yourself one question, is server connecting to the client or client to the server? What business does server have in maintaining the session or refreshing the token? Client should simply take initiative in this case cause it is more resourceful.
    – nethero
    Commented Dec 23, 2020 at 12:07

1 Answer 1


Here is where your logic breaks down:

assuming it has the refresh token

Why would the server have the refresh token?

It's important to understand the role these play in this process. A JWT has a short expiration because they are stateless and cannot be invalidated. Short expirations are inconvenient for users, so the system has a refresh token which is long lived and revokable. Therefore the client uses the JWT for authentication on every request and uses the refresh token to fetch a new JWT when it expires.

A key issue this is meant to solve is stolen JWTs. If an attacker steals a JWT then they lose access as soon as it expires. The refresh token are less-frequently used so are hopefully harder to steal, but are revokable regardless. Therefore you secure an account with suspicious activity by revoking any refresh tokens - this effectively forces all clients to log out once their JWTs expire.

If the server stored the refresh token and automatically handed out new JWTs when a JWT approached expiration, then this would effectively make the JWTs permanent, which is a real problem. In particular, how do you differentiate between clients? If you revoke the refresh token to kick out an attacker, and then the user changes their password and logs back in, what will stop your system from just handing out a new JWT to an attacker who has a previously stolen one (presuming their JWT had not yet expired)?

If everyone has their own refresh token then you don't have to worry about it. Revoking refresh tokens is an effective way to get attackers with stolen credentials out of the account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .