title: Is it secure to store a refresh token in the database? (To issue new access tokens for login purposes). Or is there a method to do it easier?
body: <p>Currently im trying to gather knowledge on how to implement an auth system (a login) . And during my research i've tried to implement a JWT based solution in my backend.</p>
  
  <p>I have an express server which allows me to register an user , storing its password (encrypted) and its email.</p>
  
  <p>After that on login, it generates an access token (short lived, 5min) , in order to access protected routes, and a refresh token (long lived, 7 days), in order to generate new access tokens once the previous expire.</p>
  
  <p>In my current implementation, im storing the refresh token in my database, so I can use it every time I want to generate a new access token.</p>
  
  <p>But is that secure? As far as I understand, storing an access token in my database is dangerous, so its better to create a short lived cookie stored one. But... the refresh token? As far as i understand it would be dangerous since it basically allows to generate new access tokens, so I dont see the point of why not simply storing a long lived access token in my database, an generating a new one in every login.</p>
  
  <p>Whats is the refresh token for then?</p>
  
  <p>Since im following some tutorials in order to achieve this, this is how my refresh_token route looks</p>
  
  <pre><code> //get a new access token with a refresh token
  app.post('/refresh_token', (req, res) =&gt; {
      const token = req.cookies.refreshtoken
      //if no token in request
      if(!token) return res.send({accesstoken : ''});
      //if we have a token we verify it
      let payload = null;
      try{
          payload = verify(token, process.env.REFRESH_TOKEN_SECRET);
      }catch(err){
          return res.send({accesstoken: ''});
      }
      //if token is valid check if user exist
      const user = fakeDB.find(user =&gt; user.id === payload.userId)
      if(!user) return res.send({ accesstoken: ''});
      //if user exists check if refreshtoken exist on user
  
      //Is this really necessary? &lt;-------------------------------------------
  
       if(user.refreshtoken !== token){
           return res.send({accesstoken: ''}) 
       }
  
  
      //if token exist create a new Refresh and Accestoken
      const accesstoken = createAccessToken(user.id);
      const refreshtoken =  createRefreshToken(user.id);
      user.refreshtoken = refreshtoken;
      //send new refreshtoken and accesstoken
      sendRefreshToken(res, refreshtoken);
      return res.send({accesstoken});
  })
  </code></pre>
  
  <p>The arrow comment is where I have my doubts, ok its returning an empty access token if my database table user (its a mock database so an array so far) , doesnt have stored a refresh token. But why would you do that? Is that used to not let arbitrary users generate access tokens? As far as I understand thats the only reason of why would I do that.</p>
  
  <p>But again then, isnt it dangerous to store in a database? WHy not simply store the access token then make it a long lived token, and generate a new one in every login?</p>
  
  <p>Is there a method to do it simplier than with jwt?</p>