title: req.user losing data after jwt refresh
body: <p>First let me provide all the relevant code then I will explain my issue</p>
  <p>my middleware to authenticate jwt</p>
  <pre class="lang-js prettyprint-override"><code>module.exports.authenticateToken = (req, res, next) =&gt; {
    const authHeader = req.headers[&quot;authorization&quot;];
    const token = authHeader &amp;&amp; authHeader.split(&quot; &quot;)[1];
  
    if (!token) {
      return res.status(401).json({ success: false, msg: &quot;not authorized&quot; });
    }
  
    jwt.verify(token, process.env.ACCESS_TOKEN_SECRET, (err, user) =&gt; {
      if (err) {
        return res
          .status(403)
          .json({ success: false, msg: &quot;jwt cannot be verified&quot; });
      }
      req.user = user;
      next();
    });
  };
  </code></pre>
  <p>my code that generates access and refresh tokens</p>
  <pre class="lang-js prettyprint-override"><code>module.exports.generateAccessToken = (user) =&gt; {
    const payload = {
      sub: user._id,
      name: user.username,
    };
  
    return jwt.sign(payload, process.env.ACCESS_TOKEN_SECRET, {
      expiresIn: &quot;20s&quot;,
    });
  };
  
  module.exports.generateRefreshToken = (user) =&gt; {
    const payload = {
      sub: user._id,
      name: user.username,
    };
  
    return jwt.sign(payload, process.env.REFRESH_TOKEN_SECRET);
  }
  </code></pre>
  <p>this is what happens when a user logs in (im storing refresh tokens in an array rn I will change that when I get all this to work properly)</p>
  <pre class="lang-js prettyprint-override"><code>module.exports.postAuthLogin = async (req, res) =&gt; {
    const { username, password } = req.body;
  
    try {
      const user = await User.findOne({ username });
  
      if (!user) {
        return res.status(401).json({ success: false, msg: &quot;Invalid username&quot; });
      }
  
      const passwordIsValid = validatePasswordHash(
        password,
        user.salt,
        user.hash
      );
  
      if (!passwordIsValid) {
        return res.status(401).json({ success: false, msg: &quot;Invalid password&quot; });
      }
  
      const accessToken = generateAccessToken(user);
      const refreshToken = generateRefreshToken(user);
  
      refreshTokens.push(refreshToken);
      res.status(200).json({ success: true, accessToken, refreshToken });
    } catch (err) {
      return res.json({ msg: err.toString() });
    }
  };
  </code></pre>
  <p>finally this is what runs when a user makes a request to refresh there token</p>
  <pre class="lang-js prettyprint-override"><code>module.exports.postAuthRefreshToken = (req, res) =&gt; {
    const { refreshToken } = req.body;
  
    if (!refreshToken) {
      return res
        .status(401)
        .json({ success: false, msg: &quot;must provide a refresh token&quot; });
    }
  
    if (!refreshTokens.includes(refreshToken)) {
      return res.status(403).json({
        success: false,
        msg: &quot;refresh token was deleted you must login again&quot;,
      });
    }
  
    jwt.verify(refreshToken, process.env.REFRESH_TOKEN_SECRET, (err, user) =&gt; {
      const accessToken = generateAccessToken(user);
      res.status(200).json({ success: true, accessToken });
    });
  };
  
  </code></pre>
  <p>so my issue is initially when I login and get my refresh and access token, then I request a route that is protected with the authenticateToken middleware my req.user in that route looks something like this</p>
  <pre class="lang-js prettyprint-override"><code>{
    sub: '5ff5f16f4203ade4d1b63da8',
    name: 'test1',
    iat: 1610055109,
    exp: 1610055129
  }
  </code></pre>
  <p>but when my token expires and I request a new one it does get verified and im able to access the protected route BUT my req.user looks like this</p>
  <pre class="lang-js prettyprint-override"><code>{ iat: 1610055143, exp: 1610055163 }
  </code></pre>
  <p>I have been banging my head against the wall with this problem for a little while now so any help would be more then appreciated and if you need anymore info just say something and ill 100% provide it</p>