1

I am doing a small login, but I am trying to do it in the best possible way, I was testing only with a token and saved it in the DB, then decrypted and compared with the token, if it was the same and it was not expired then it allowed access, otherwise he denied access. But they told me that the Token should not be stored in the BD and they recommended me to use a refreshToken in addition to the token (access token). As I have read, the advantage of using a refreshToken is not forcing the user to have to log in again once the access token expires, and in this case, the refreshToken if it should be saved in the BD as I understand, is this the only advantage? in addition I also read that the refreshToken should also expire, how would it be done in this case? you should have to add 3 columns to the table of each user (refreshToken, date of issue and expiration? another question I have is that I saw in a place that to know if the access token is valid they only decrypt it and if it is achieved decrypting means that it is valid, that is, there would be no need to compare if it is equal to the token generated by the backend? excuse so many questions, but no matter what I have read it has not been clear to me, or I do not know if the guides that I have found they are not entirely complete I am very grateful to anyone who can help me understand this better Thank you in advance Greetings!

JulianProg
  • 183
  • 1
  • 5
  • 16
  • https://stackoverflow.com/questions/38986005/what-is-the-purpose-of-a-refresh-token – fedeteka May 17 '20 at 20:20
  • 1
    Hello @fedeteka! I had already read that question and even more, for that reason I tried to ask specific questions where I have doubts. For example, is it enough just to decode the token and if it is successful to allow access or should the token be saved in the DB and compare each time with the token sent by the client? When the refreshToken is used, does it have to be saved in the DB together with an expiration date? at least these would be good practices? – JulianProg May 17 '20 at 21:36

0 Answers0