In my project, I utilize jwt tokens with a strategic approach. Long-lived refresh tokens are employed for authentication purposes, while short-lived access tokens are used to safeguard protected resources. To enhance security against xss attacks, the refresh token is securely stored in a http-only cookie. As for the access tokens, they are exclusively retained within the vuex store of the frontend. A question arises - should the refresh token be renewed when a user changes their password? Unlike traditional methods, I choose not to store refresh tokens in my database, leveraging the cryptographic capabilities of jwts for verification purposes without requiring a lookup operation.
However, an issue presents itself - how can an already dispatched refresh token be invalidated, such as on a different device or browser? Without a designated storage mechanism for refresh tokens, their validity persists until the expiration time lapses. Seeking insights and advice on this matter. Appreciation in advance.