I am trying to implement JWT in a secure way in Node.js and I am unsure when to request the refresh token.
I got one access token and one refresh token. Both are saved in two httpOnly cookies. When the access token expires the refresh token should check for a new one.
Right now I have implented it so that if the refresh token fails to validate the access token (
if (err)) It requests the refresh token. The refresh token is then checked against the database and issues a new access token as well as validate the user for the route.
Is this a correct way of doing it?
I read somewhere that the refresh cookie should be set to a specific path instead for more security, but if so how do you call it when the access token expires?