title: Signing jwt token with refresh token as payload
body: <p><strong>How I understand jwt based authentication should work:</strong></p>
  
  <ol>
  <li>Client sends log-in credentials to server.</li>
  <li>Server verifies if credentials are correct and responds with a signed jwt token and a refresh token, while also storing the refresh token in database.</li>
  <li>Client uses jwt token as a Authentication header in all requests. </li>
  <li>When the jwt token has expired, server responds with <code>401 Unauthorized</code>.</li>
  <li>Client sends a request to refresh the jwt token with the refresh token in the Authentication header.</li>
  <li>Server check if the refresh token exists in database and that it has not expired. Then responds with a new jwt token</li>
  <li>Client can continue requesting with the new token.</li>
  </ol>
  
  <p><strong>How I want to implement it:</strong></p>
  
  <p>If the desciption above is correct, is there anything wrong with putting the refresh token as payload for the signed jwt token?:</p>
  
  <pre><code>function signToken(id, role, refresh_token) {
      return jwt.sign(
          {
              _id: id,
              role: role,
              refresh_token: refresh_token
          },
          config.jwt.secret,
          {
              expiresIn: 60*60*24, // expires in 1 day
          }
      );
  }
  </code></pre>
  
  <p>And in that way always sending both the refresh token and jwt token in every request? By doing this, the client would not have to send a seperate request with the refresh token to get a new jwt token:</p>
  
  <ol>
  <li><em>Same as above</em></li>
  <li><em>Same as above</em></li>
  <li><em>Same as above</em></li>
  <li>When the jwt token has expired, the server picks out the refresh token from the jwt token and checks if it exists in database and that it is not expired. </li>
  <li>Server responds with the requesed resource + a new jwt token.</li>
  <li>Client sees that there is a new token in the response and saves it for further requests.</li>
  </ol>
  
  <p>Auth middleware would look something like this:</p>
  
  <pre><code>function authenticate (req, res, next) {
  
      // Token attached to request in previous middleware
      let token = req.token
  
      // verifies secret and checks exp
      jwt.verify(token, config.jwt.secret, {ignoreExpiration: true}, (err, decoded) =&gt; {
          if (err) {
              return res.status(500).json({ success: false, message: err.message });
          }
          //Expired token, try to refresh
          if(decoded.exp*1000 &lt; Date.now()){
              User.findById(decoded._id, (err, user) =&gt; {
                  if(err) {return res.send(err);}
                  if(!user){
                      return res.status(500).json({ success: false, message: 'Token owner not found.' });
                  }
  
                  //if refresh token found, and not expired, refresh expiry time
                  let isValidToken = _(user.refresh_tokens)
                                          .filter( (token) =&gt; {return token.expires&gt;Date.now()} )
                                          .any({token: decoded.refresh_token});
                  if(!isValidToken){
                      req.user = {role: 'Guest'};
                      return next();
                  }
  
                  let newToken = signToken(decoded._id, decoded.role, decoded.refresh_token);
                  req.token = newToken;
                  req.user = decoded;
                  return next();
              })
          } else {
              // if everything is good, save to request for use in other routes
              req.user = decoded;
              return next();
          }
      });
  }
  </code></pre>