Refresh token concept in Express - Step-by-Step Execution

Concept Flow - Refresh token concept

User logs in

↓

Server issues Access Token + Refresh Token

↓

User uses Access Token to access resources

↓

Access Token expires?

No→Continue Access

Yes↓

User sends Refresh Token to server

↓

Server verifies Refresh Token

↓

If valid, server issues new Access Token

↓

User continues with new Access Token

↓

If Refresh Token invalid, user must log in again

This flow shows how a user gets tokens, uses the access token until it expires, then uses the refresh token to get a new access token without logging in again.

Execution Sample

Express

app.post('/token', (req, res) => {
  const refreshToken = req.body.token;
  if (!refreshToken) return res.sendStatus(401);
  if (!refreshTokens.includes(refreshToken)) return res.sendStatus(403);
  jwt.verify(refreshToken, REFRESH_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    const accessToken = generateAccessToken({ name: user.name });
    res.json({ accessToken });
  });
});

This Express route receives a refresh token, verifies it, and if valid, sends back a new access token.

Execution Table

Step	Action	Input	Check/Condition	Result/Output
1	Receive POST /token request	{ token: 'refreshToken123' }	Is token present?	Yes, proceed
2	Check if refresh token is in store	'refreshToken123' in refreshTokens?	Yes	Proceed to verify
3	Verify refresh token signature	jwt.verify(refreshToken123)	Valid?	Yes, decoded user info
4	Generate new access token	User info from token	N/A	New access token created
5	Send response	{ accessToken: 'newAccessToken456' }	N/A	Client receives new access token
6	If token missing or invalid	N/A	No or invalid token	Send 401 or 403 status

💡 Stops when refresh token is missing or invalid, or after sending new access token.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
refreshToken	undefined	'refreshToken123'	'refreshToken123'	'refreshToken123'	'refreshToken123'	undefined
refreshTokens	['refreshToken123']	['refreshToken123']	['refreshToken123']	['refreshToken123']	['refreshToken123']	['refreshToken123']
user	undefined	undefined	undefined	{ name: 'Alice' }	{ name: 'Alice' }	undefined
accessToken	undefined	undefined	undefined	undefined	'newAccessToken456'	'newAccessToken456'

Key Moments - 3 Insights

Why do we check if the refresh token is in the store before verifying it?

Because a refresh token might be revoked or logged out, so checking the store (refreshTokens array) ensures only valid tokens are accepted before verifying signature (see execution_table step 2).

What happens if the refresh token is expired or tampered with?

The jwt.verify call fails and returns an error, so the server responds with status 403, stopping the process (see execution_table step 3).

Why do we send a new access token but not a new refresh token?

Access tokens expire quickly for security; refresh tokens last longer. We only issue a new access token here to keep the session alive without forcing login again (see execution_table step 4 and 5).

Visual Quiz - 3 Questions

Look at the execution_table, what is the result at step 3 when jwt.verify fails?

A A new access token is generated

B The refresh token is added to the store

C The server sends status 403

D The user is logged out automatically

💡 Hint

Check execution_table row with Step 3 and the condition 'Valid?'

At which step does the server check if the refresh token exists in the stored list?

A Step 1

B Step 2

C Step 4

D Step 5

💡 Hint

Look at execution_table row where it checks 'refreshToken123 in refreshTokens?'

If the refresh token was missing in the request body, what would happen?

A The server sends status 401

B The server generates a new access token anyway

C The server adds a new refresh token to the store

D The server ignores the request

💡 Hint

See execution_table step 1 condition 'Is token present?' and result

Concept Snapshot

Refresh Token Concept in Express:
- User logs in and gets Access + Refresh Tokens
- Access Token used for resource access, expires quickly
- When expired, client sends Refresh Token to /token endpoint
- Server verifies Refresh Token and issues new Access Token
- Refresh Token stored server-side to allow revocation
- If Refresh Token invalid or missing, user must log in again

Full Transcript

This visual execution trace shows how refresh tokens work in an Express app. When a user logs in, the server sends both an access token and a refresh token. The user uses the access token to access protected resources. When the access token expires, the user sends the refresh token to the server's /token route. The server first checks if the refresh token is present and stored in the server's list. Then it verifies the token's signature. If valid, the server generates a new access token and sends it back. If the refresh token is missing, invalid, or expired, the server responds with an error status, forcing the user to log in again. This flow helps keep users logged in securely without asking for credentials repeatedly.

Practice

1. What is the main purpose of a refresh token in an Express app using authentication?

easy

A. To encrypt the access token

B. To store user passwords securely

C. To log out the user automatically after a timeout

D. To get a new access token without asking the user to log in again

Solution

1. Step 1: Understand the role of refresh tokens

   Refresh tokens allow the app to request new access tokens without user interaction.

2. Step 2: Compare options with refresh token purpose

   Only To get a new access token without asking the user to log in again correctly describes this purpose; others describe unrelated functions.

3. Final Answer:

   To get a new access token without asking the user to log in again -> Option D

4. Quick Check:

   Refresh token purpose = get new access token without login [OK]

Hint: Refresh tokens renew access tokens silently [OK]

Common Mistakes:

• Confusing refresh token with access token
• Thinking refresh token stores passwords
• Assuming refresh token logs out users

2. Which of the following is the correct way to send a refresh token in an Express response header?

easy

A. res.setHeader('refresh-token', token);

B. res.sendRefreshToken(token);

C. res.refreshToken = token;

D. res.header('Authorization', token);

Solution

1. Step 1: Recall Express method to set headers

   Express uses res.setHeader(name, value) to set response headers.

2. Step 2: Match correct syntax for refresh token header

   res.setHeader('refresh-token', token); uses correct method and header name; others are invalid or use wrong header.

3. Final Answer:

   res.setHeader('refresh-token', token); -> Option A

4. Quick Check:

   Set header with res.setHeader(name, value) [OK]

Hint: Use res.setHeader to send custom headers [OK]

Common Mistakes:

• Using non-existent res.sendRefreshToken method
• Assigning token directly to res property
• Using wrong header like 'Authorization' for refresh token

3. Given this Express route snippet, what will be the output if the refresh token is valid?

app.post('/token', (req, res) => {
  const refreshToken = req.body.token;
  if (!refreshToken) return res.status(401).send('No token');
  if (refreshToken !== 'validtoken') return res.status(403).send('Invalid token');
  res.json({ accessToken: 'newAccessToken123' });
});

medium

A. Status 401 with message 'No token'

B. Status 403 with message 'Invalid token'

C. JSON response with new access token

D. Empty response with status 200

Solution

1. Step 1: Check token presence and validity

   If refreshToken is missing, returns 401; if invalid, returns 403.

2. Step 2: For valid token, send new access token JSON

   When token equals 'validtoken', response sends JSON with new access token.

3. Final Answer:

   JSON response with new access token -> Option C

4. Quick Check:

   Valid token returns new access token JSON [OK]

Hint: Valid token returns JSON with new access token [OK]

Common Mistakes:

• Confusing status codes for missing vs invalid token
• Expecting empty response instead of JSON
• Ignoring token validation logic

4. Identify the bug in this Express refresh token handler:

app.post('/refresh', (req, res) => {
  const token = req.body.refreshToken;
  if (!token) res.status(401).send('Missing token');
  if (token !== 'secret') res.status(403).send('Forbidden');
  res.json({ accessToken: 'newToken' });
});

medium

A. Missing return statements after res.status calls causing multiple responses

B. Incorrect property name for token in request body

C. Using res.json instead of res.send

D. No bug, code works fine

Solution

1. Step 1: Check response flow after status calls

   Without return, code continues after sending response, causing errors.

2. Step 2: Confirm need for return to stop execution

   Adding return after res.status(...).send(...) prevents multiple responses.

3. Final Answer:

   Missing return statements after res.status calls causing multiple responses -> Option A

4. Quick Check:

   Return after res.status to stop code [OK]

Hint: Always return after sending response to avoid errors [OK]

Common Mistakes:

• Not returning after res.status sends response
• Assuming res.json is wrong here
• Thinking property name is incorrect

5. You want to implement refresh token rotation in Express to improve security. Which approach correctly applies this concept?

hard

A. Keep the same refresh token forever to avoid user re-login

B. Issue a new refresh token on each use and invalidate the old one

C. Send refresh token only once during login and never again

D. Store refresh tokens in localStorage on the client side

Solution

1. Step 1: Understand refresh token rotation

   Rotation means issuing a new refresh token each time the old one is used and invalidating the old token.

2. Step 2: Evaluate options for security best practice

   Issue a new refresh token on each use and invalidate the old one matches rotation concept; others either reduce security or misuse storage.

3. Final Answer:

   Issue a new refresh token on each use and invalidate the old one -> Option B

4. Quick Check:

   Refresh token rotation = new token each use [OK]

Hint: Rotate refresh tokens by replacing old with new each use [OK]

Common Mistakes:

• Reusing same refresh token indefinitely
• Not invalidating old refresh tokens
• Storing tokens insecurely on client side