I've read a few articles which cover the set up for refresh tokens and JWT tokens
Is there a best practice in how/when to get the next JWT token.
In my head, there are a few different approaches. I will ignore authorisation for this post.
- Log in and authenticate
- On each server request, pull back a new JWT and refresh the cookie token
Or
- Log in and authenticate
- If the request to the server fails due to non-authenticated, then attempt to get a new token. If this is a success, repeat the original request, otherwise, assume not logged in
Another approach would be
- Log in and authenticate
- Have a polling task that executes every n minutes. Before the JWT expires, refresh and pull a new token
I am aware in software we have the ability to approach things in different ways based upon the problem we are trying to solve. However, it does feel that this must be something the software community have tried and tested and overall there is a default pattern?