How to add refresh token? - node.js

Question

I have the following code i would like to add refresh token. How can I add it?
I am also asking for suggestions on how to improve the quality of the authorization method.
Unfortunately, my attempts always ended with an error or the lack of a specific action.
This is my snippet of code:
const path = require('path');
const express = require('express');
const bodyParser = require('body-parser');
const urlencodedParser = bodyParser.urlencoded({ extended: false });
const mysql = require('mysql2');
const jwt = require('jsonwebtoken');
require('dotenv').config();
const TOKEN_SECRET = process.env.TOKEN_SECRET;
const app = express();
app.use(express.json());
const pathPublic = path.join(__dirname, '../public');
app.use(express.static(pathPublic));
app.post('/login', urlencodedParser, (req, res) => {
res.get(req.body.username + req.body.password);
const users = {
username: req.body.username,
password: req.body.password
};
// Connect to MySql
const db = require('./dbconnect');
// Select user:
const post = [users.username, users.password]
const sql = 'SELECT * FROM users WHERE name = ? AND password = ?';
const query = db.query(sql, post, (err, results) => {
if (err) {
throw err;
} else if (results.length >= 1) {
console.log("Successful login!!");
const token = generateAccessToken({ username: users.username });
res.redirect(`/admin?token=${token}`);
} else if (results.length <= 0) {
console.log("Not find user");
}
})
})
function generateAccessToken(username) {
return jwt.sign(username, TOKEN_SECRET, { expiresIn: '600s' });
}
function authenticateToken(req, res, next) {
token = req.query.token;
if (token == null) return res.sendStatus(401);
jwt.verify(token, TOKEN_SECRET, (err, user) => {
if (err) console.log(err);
if (err) return res.sendStatus(403);
req.user = user;
next();
});
}
app.get('/admin', authenticateToken, (req, res) => {
res.send('admin panel');
});

Answer 1

There are multiple ways of implementing refresh token in Nodejs, one way that I use a lot is to generate a new JWT with more expiration time than the access token, for instance 30 minutes for the access and 48 hours for the refresh one, to differentiate those tokens I add an additional payload called type, the value that you put in that property is yours but it can be simple text as ACCESS and REFRESH, then I will modify the authentication middleware to validate token and verify that the type property be equal to ACCESS, if the value of the property is different I will send an unauthorized response, when the token access is invalid, I will use the refresh jwt to generate a new access one, for that I would create another middleware which extracts information from the token and verifys that the type be equal to REFRESH if everything is correct then I will generate a two new token one for access and another for refresh.
This is the basic implementation you can improving it in many ways, for instance to have a blacklist to allow only use the refresh token once, but this is the general idea.
An example can be found here.