JWT 身份验证中刷新令牌的正确实现是什么

Question

I'm trying to implement JWT authentication in my React & Nodejs application using jsonwebtoken .

I currently have a JWT authentication in place that generates an access_token when singing in. I want to properly implement JWT in my application so I'm looking to implement the use of a refresh_token aswell.

My question: What is the best way of implementing this? How do I prevent a potential attacker with access to the user's refresh_token to gain access to protected resources?

Code:

User sign in route with token creation:

router.post("/login", async (req, res) => {
  const { username, password, remember } = req.body;

  if (!username || !password) {
    return res.status(400).json({ message: "Please fill in all fields." });
  }

  try {
    // find user based on username
    const user = await User.findOne({ username });
    if (isEmpty(user))
      return res.status(400).json({ message: "User does not exists." });

    // compare requested password to db password with bcrypt
    const isValid = await bcrypt.compare(password, user.password);

    if (!isValid)
      return res.status(400).json({ message: "Invalid credentials" });

    // sign a JWT token to user
    const token = jwt.sign({ id: user.id }, config.get("jwtSecret"), { expiresIn: 3600, });

    // if remember user === true sign a refresh token to the user
    if(remember) {
      const refreshToken = jwt.sign({ id: user.id }, config.get("jwtSecret"), { expiresIn: '30d'});
    }
    // send user & tokens to frontend

  } catch (error) {
    console.log(error);
  }
  

My middleware that needs to succeed before accessing user data:

function auth(req, res, next) {
  const token = req.header("x-auth-token");

  if (!token)
    return res.status(401).json({ message: "No token, authorization denied." });

  try {
    const decoded = jwt.verify(token, config.get("jwtSecret"));
    req.user = decoded;
    next();
  } catch (error) {
    return res.status(400).json({ message: "Token is not valid" });
  }
}

Using this middleware in my router for accessing user data:

// GET api/auth/user
// DESC get user data based on token

router.get("/user", auth, (req, res) => {
  User.findById(req.user.id)
    .select("-password")
    .then((user) => {
      return res.status(200).json({
        user: {
          id: user.id,
          username: user.username,
          email: user.email,
        },
      });
    });
});

Where does my refresh_token come in to place to finish off my secure JWT authentication?

Answer 1

Your refresh token has 1 single job: Generate access tokens, thats'it, not give direct access to resources, this is access tokens job.

By doing that, you can put a short expire date on generated access tokens because you're gonna give user a chance to request an other once it expires. I really don't see the point to store them in database.

1- Concerning your bunch of code, use another key to sign your refresh tokens, don't use the same key for both.

2- Make sure to store refresh tokens for every user in order to be able to revoke them if needed, and check that he owns them for real (database check).

3- Create a route (/token for example) that generates new access_tokens for users (here you need to check in database that user really owns refresh-token he's using).