How to refresh JWT tokens in Node.js
Łukasz Holeczek
Follow Łukasz Holeczek on GitHub
Connect with Łukasz Holeczek on LinkedIn
Follow Łukasz Holeczek on X (Twitter)
Implementing JWT token refresh enhances security by using short-lived access tokens paired with longer-lived refresh tokens for automatic renewal. As the creator of CoreUI with extensive Node.js authentication experience since 2014, I’ve implemented token refresh systems in numerous enterprise applications. The most secure approach uses separate access and refresh tokens, where refresh tokens are stored securely and used exclusively for generating new access tokens. This pattern provides optimal security while maintaining seamless user experience without frequent re-authentication.
Create separate access and refresh tokens with a dedicated refresh endpoint for secure token renewal.
const jwt = require('jsonwebtoken')
function generateTokens(user) {
const accessToken = jwt.sign(
{ id: user.id, email: user.email },
process.env.JWT_ACCESS_SECRET,
{ expiresIn: '15m' }
)
const refreshToken = jwt.sign(
{ id: user.id },
process.env.JWT_REFRESH_SECRET,
{ expiresIn: '7d' }
)
return { accessToken, refreshToken }
}
// Refresh token endpoint
app.post('/auth/refresh', (req, res) => {
const { refreshToken } = req.body
jwt.verify(refreshToken, process.env.JWT_REFRESH_SECRET, (err, decoded) => {
if (err) return res.status(403).json({ error: 'Invalid refresh token' })
const newAccessToken = jwt.sign(
{ id: decoded.id },
process.env.JWT_ACCESS_SECRET,
{ expiresIn: '15m' }
)
res.json({ accessToken: newAccessToken })
})
})
This code generates both access tokens (15 minutes) and refresh tokens (7 days) with different secrets. The refresh endpoint validates the refresh token and issues a new access token without requiring user credentials. This approach minimizes the window of vulnerability while providing automatic token renewal for active users.
Best Practice Note:
This is the token refresh strategy we use in CoreUI production APIs for optimal security and user experience. Store refresh tokens in secure HTTP-only cookies and implement token blacklisting for enhanced security in critical applications.
