Comment on Managing a Secure JSON Web Token ImplementationComments−kyriakos7yWhen is the refresh token meant to be expiring? Can't the man in the middle just use the refresh token to get a new valid jwt?−thangngoc897yFrom the article, refresh tokens are revokable. The whole point of JWT + refresh token is that for normal operation, you don't need to hit the database but still able to revoke a token.
Comments
When is the refresh token meant to be expiring? Can't the man in the middle just use the refresh token to get a new valid jwt?
From the article, refresh tokens are revokable. The whole point of JWT + refresh token is that for normal operation, you don't need to hit the database but still able to revoke a token.