3 ms·
When is the refresh token meant to be expiring? Can't the man in the middle just use the refresh token to get a new valid jwt?
by kyriakos 7y ago
When is the refresh token meant to be expiring? Can't the man in the middle just use the refresh token to get a new valid jwt?
- thangngoc89 7y agoFrom the article, refresh tokens are revokable. The whole point of JWT + refresh token is that for normal operation, you don't need to hit the database but still able to revoke a token.