Should refresh tokens be stored in database?
You can replace the refresh token on each refresh, but remember that you need to store all expired refresh tokens until their lifetime is over. From a security perspective it makes sense to create a new token, but it is a trade off between security and amount of data in your database.
Where are refresh token servers stored?
Access token and refresh token shouldn’t be stored in the local/session storage, because they are not a place for any sensitive data. Hence I would store the access token in a httpOnly cookie (even though there is CSRF) and I need it for most of my requests to the Resource Server anyway.
How to handle the use of refresh tokens?
You can just use the refresh token for each access. User logs in, gets access and refresh token. Access token lifetime 15min, refresh token 5 days. User accesses the service using the access token. Service only checks signature and lifetime. No database connection.
Do you need to check for expired access tokens?
You never need to check for expired access tokens or have any state, but limit abuse to the lifetime of the token. If you don’t have the requirement to accept the tokens without checking expiration in a database, you don’t need the two different tokens. You can just use the refresh token for each access. User logs in, gets access and refresh token.
When to request a refresh token in OpenID Connect?
A refresh token can be requested by an application as part of the process of obtaining an access token. Many authorization servers implement the refresh token request mechanism defined in the OpenID Connect specification. In this case, an application must include the offline_access scope when initiating a request for an authorization code.
Can a refresh token be invalidated after logout?
In practice, therefore, it’s not uncommon for a refresh token to be issued on login, and invalidated on logout or after a period of inactivity. In this case, it can be part of the session data on the server, and hence automatically linked to the current user.