在服务器上刷新后刷新令牌本地存储

Question

How do you handle jwt token after it has expired?

I really need to know what is the best thing to handle token in local storage, On my server, if the token on header is expired, I refresh it, and the token in local storage will not updated after it refresh from server, I could think each respond after refresh token, I will set the token on each response then set it to local storage, for every request which need the token, but I am sure it is not efficient and too much work, right? what is the best practice to handle refresh token from server for client-side?

Answer 1

I'm not sure if this helps or not but in many workflows it's the client driving the request. If possible, it may help to simplify the problem:

The client needs a valid token to make a request

If you're able to make this assumption then this can allow you to push the responsibility of token management to the client. Then the server will reject ANY request with an invalid token and return unauthorized to the client. This makes it the clients responsibility to re-auth or refresh by keeping track of token validity.

This separates concerns so that the server doesn't need to have token management and refresh on each request.

---

I'm basing this on Single Page Application Authentication workflows like described https://auth0.com/docs/architecture-scenarios/spa-api