This is how I do my JWT refresh token:
A token is check for validity every time a request is made. If it's not expired, allow access.
If it's expired calls another function named RefreshToken to give a new token to the user.
Ok this mechanism is good enough except that every expired token (of that user, provided that it is valid) can fire up the creation of a new fresh token.
Expiration is at 15 minutes.
Token A is created.
Token A asks for a new refresh token after 1 hour.
New token is issued, named Token B.
After 15 minutes, Token B is expired.
Now, Token A and Token B can ask for a new token.
Wouldn't that create the ability to issue token exponentially?
Just from 1 token.
And the token can issue another token and so on. An expired token 15 years ago can issue a new refresh token today even though it was used some time in 15 years ago and had issued another token too.
Now every token issued can create another token. Can I just allow Token A --> Token B --> Token E without storing expired token into database?
Order of token alphabet takes precedence