title: How to use a JWT Refresh Token to generate a new Access Token
body: <p>I'm using Node.js and Express to deal with JWT Auth. First of all, every time a user is created and verified, I'm storing a <code>refresh token</code> inside <code>User</code> collection:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>const refreshToken = await jwt.sign({ userId: decoded.user }, process.env.JWT_Refresh_Key);
  const user = await User.updateOne({ _id: mongoose.Types.ObjectId(decoded.user) }, { refresh_token: refreshToken, status: true });</code></pre>
  </div>
  </div>
  </p>
  
  <p>A JWT Access Token is generated after a successful Login (expires after 15min):</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>const token = await jwt.sign(
                  { email: user.email, userId: user._id, role: user.role },
                  process.env.JWT_Key,
                  { expiresIn: '15m' });
  res.status(200).json({success: true, token: token});</code></pre>
  </div>
  </div>
  </p>
  
  <p>Then <code>access token</code> is stored in <code>localStorage</code> to be handled by Angular Http Interceptor and auth methods. After 15min, the <code>token</code> will be invalid for handling requests, so I need to use the <code>refresh token</code> stored on the database.</p>
  
  <p>Refresh method is being called on <code>AuthService.ts</code>:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>export class AuthService {
    constructor(private http: HttpClient){}
  
    refreshToken(token: string) {
        this.http.post&lt;{token: string, expiresIn: number, name: string}&gt;(`${BACKEND_URL}/refreshtoken`,     {token: token})
          .subscribe((data) =&gt; {
            const expiresAt = moment().add(data.expiresIn, 'second');
            localStorage.setItem('token', data.token);
            localStorage.setItem('expiration', JSON.stringify(expiresAt.valueOf()));
          });
      }
  }
  
  //route
  router.post('/refreshtoken', user.refreshToken);
  
  //controller user.js
  exports.refreshToken = async(req, res, next) =&gt; {
      // I need to store and call 'old_refreshtoken' where??
      const user = await User.findOne({ refresh_token: old_refreshtoken });
      if (user) {
          const newToken = await jwt.sign(
              { email: user.email, userId: user._id, role: user.role },
              process.env.JWT_Key,
              { expiresIn: '15m' });
          res.status(200).json({success: true, token: newToken, expiresIn: 900, name: user.name});
      } else {
          res.status(401).json({success: false, message: 'Autenticação falhou.'});
      }
  };</code></pre>
  </div>
  </div>
  </p>
  
  <p>How can I use my <code>refresh token</code> (database) to generate a new <code>access token</code>?
  I'm not sure how to store a <code>refresh token</code> on client-side (Angular) to compare to <code>refresh token</code> stored on the database.</p>