I'm struggling to grasp the concept of refresh tokens. Should I generate them in the same way as access tokens using the 'jsonwebtoken' package? Or is there a different package for creating refresh tokens? Additionally, should I store the same information in the refresh token as I do in my access token? And where should I store my refresh token - in the same location as my access token?
I've scoured the internet for answers, but most tutorials focus on access tokens or extol the security of JWT without delving into refresh tokens. Just to clarify, I am using Express framework.