title: JWT and authentication safety/patterns
body: <p>Im building an authentincation and authorization system in javacript using JWT token
  basically when i login i store in httponly cookies:</p>
  <ul>
  <li>JWT Token</li>
  <li>JWT Refresh Token</li>
  <li>user information (id, username, email)</li>
  <li>JWT expiration (5 minutes from when it's generated)</li>
  </ul>
  <p>When the JWT is still valid protected pages will do a remote check for user validity (i request an API passing the userId and the auth token as an authorization bearer)
  the remote check can take some time (less than a second), but every protected page shows a loading spinner while checking; i was wondering how safe is assuming the user is logged in it the JWT is still valid (or the refresh token get a new JWT) and the cookie with the user data is present. No external requests involved, unless you need to refresh the JWT</p>