Understanding refresh tokens
Before we can implement them, we need to understand what refresh tokens are used for, what they actually are, and why we would want to use them on top of our current JSON Web Token (JWT)-based access tokens.
What are refresh tokens used for?
Let's start by understanding the basics of what we're actually going to use refresh tokens for, before diving into the nitty gritty of what they are actually composed of. As the name implies, a refresh token is used for refreshing an existing token—or more specifically, refreshing an existing access token.
Refresh tokens are used to obtain a new access token as and when your existing access token expires. What's more, this doesn't require any input from the user; it is all done silently in the background without them even knowing. Essentially, this enables users to remain logged in indefinitely. At this point, you might be wondering about the security aspect of this, but don't worry, we're actually increasing the security of...
