12May
Should login/refresh authentication routes return new tokens if an existing, valid token is present?
My server sets cookies with the JWT and refresh tokens on login, and likewise when the refresh route is hit. If a valid JWT cookie is found in the request for these routes, should a new one be issued? If so, should the old be blacklisted? And if not, what would be a valid response code?
