This doing a Spring Boot application (Rest API, JPA, etc) uses (via Rest) from a website (Angular) and a mobile app (Android).
The user using the mobile app (in the future) will be able to authenticate via Facebook, Google, etc, and store in the database some information received from the social networks necessary for the app.
I implemented the authentication by providing username and password(saved on a database) and by releasing an access token (JWT) from the backend, used by both frontend at every REST request to Spring Boot.
Now I would like that for the user's mobile app not to be entered username and password every time, but to remain logged in for "always".
Reading on the internet I saw that it is possible to generate a refresh token that the app can use when the backend (Spring Boot) returns HTTP Error 401. The app uses the refresh token to ask the backend for a new access token. If the refresh token has also expired then the user is forced to re-enter the username and password otherwise if it remains logged.
When does the refresh token need to be updated? Because otherwise when the refresh token expires I have to force the user to enter the credentials.
Which flow is correct and secure?
If not sure what should I use?