title: Handling JWT expiration and JWT payload update
body: <p>I have a Koa based Node.js backend for my personal/hobby application.</p>
  <p>I implemented session handling with JWT tokens. The client (AngularJS) gets the token after a successful login and stores the token somewhere (currently in <code>sessionStorage</code> but for the purposes of this question it shouldn't matter).</p>
  <p>I have two questions:</p>
  <ol>
  <li><p>When I need to update the user record which the JWT represents, say, the user turned on Two-factor authentication (2FA) so I asked him to provide his phone number and I'd like to set this phone number in the user's record. Currently, after a successful verification on the phone number I call my backend to update the user record and I create a new JWT token with the updated user record (I exclude sensitive information from the JWT token like the hashed password, but I'd like to include the phone number for client side usage). Is it okay to create a new token when some of the credentials change and update the existing client side token with this new token? Should I never-ever create another token, only to create the one and only upon successful authentication? How do I then update the payload in the token?</p>
  </li>
  <li><p>How should I handle expired JWT tokens? In my mind I have 3 (possible) scenarios:</p>
  </li>
  </ol>
  <p>2.1. The JWT is set to short living, say 15 minutes. If the backend server replies with a <em>401 Unauthenticated</em> 'Invalid token' (I guess this is the default behavior of <code>koa-jwt</code>) then I automatically log-out my client and require re-authentication. But I also set up a complementary middleware, which is the last in the chain on the backend to re-create the token with a refreshed expiry and the client would also replace the existing token with the refreshed one. So if the user is active and uses the application every protected API call, in case of success, would create a new token to replace the old token.</p>
  <p>2.2. The JWT is set long-living, say 1 week, and if it expires I opt-in re-authentication from the client.</p>
  <p>2.3. Copy <a href="https://www.rfc-editor.org/rfc/rfc6749#section-1.5" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc6749#section-1.5</a>. Here when creating the JWT token after a successful authentication we send an access_token as well as a refresh_token. When the access_token is expired and the server responds with <em>HTTP 401</em> 'invalid token' (<code>koa-jwt</code> default) then the client sends the refresh_token to the backend to require a new access_token (and optionally a new refresh_token). In this case I don't fully understand how the refresh_token is verified against the old access_token to provide a new token? Or why do we need to have a refresh_token?</p>
  <p>Any generic advice on the upper topics (JWT updates and JWT expiration) would be helpful.</p>