JWT access + refresh tokens: common mistakes

This post rounds up common mistakes when implementing JWT access/refresh tokens.

Common mistakes

Not revoking the old refresh token when issuing a new one, and storing tokens in localStorage where they're exposed to XSS.

How to fix it

Rotate the refresh token on every use, and prefer an httpOnly cookie over localStorage where possible.