search

hagopj13 / node-express-boilerplate

A boilerplate for building production-ready RESTful APIs using Node.js, Express, and Mongoose
MIT License
6.66k stars 1.98k forks source link

Authentication: Is refresh token never expired? #252

Closed thangcqUET closed 12 months ago

thangcqUET commented 1 year ago

First, thank you for your repo. In code base, I saw that: When access token was expired, client will send refresh-tokens API to server and receive both new access token and new refresh token as well as remove old refresh token in DB. The problem is new refresh token has new expire time instead of old expire time. That make refresh token is never expired. I don't know if you did it on purpose? Is any mechanism behind it?

chintanshahts commented 12 months ago

@thangcqUET As we are removing the refresh token from the database and returning the new token, If anyone tries with the old refresh token, it will throw some error. Because the token is valid but does not exist in the database.

thangcqUET commented 12 months ago

@chintanshahts So when is refresh token expired? Or It never is expired because the expiration is always renewed every time a refresh token is created. And therefore, we don't need an expiration for refresh token? Is it right?

chintanshahts commented 12 months ago

@thangcqUET Suppose we have set the refresh token expire time to 1 day(i.e. 24 hours) and access token expire time to 1 hour. If user don't refresh the token for 24 hours from the creation time, the refresh token will be expired.

thangcqUET commented 12 months ago

Gotcha. I missed this case. Thank you 😊