How do access tokens and refresh tokens work together?
Model answer
The access token is short-lived (minutes) and sent with API calls. The refresh token is longer-lived, stored securely (HttpOnly cookie), and used only to get a new access token. Rotate refresh tokens on use, store them server-side (hashed) so you can revoke them on logout or theft, and detect reuse.
Learn this topic
Login with JWT: Sign In, Issue a Token and Avoid Timing Leaks in the course MERN Stack Full Course: MongoDB, Express, React and Node.js.
Sign in to add your own answer.