Handling JWT access/refresh tokens safely

The JWT access token is short-lived (15 minutes); the refresh token reissues a new access token without requiring re-login.

Refresh token rotation

Each refresh revokes the old token and issues a new one — preventing replay if a token is ever stolen.

Client-side storage

Only a SHA-256 hash of the refresh token is stored server-side; clients should store it somewhere safe (an httpOnly cookie where possible).