Comparison
JSON Web TokenvsRefresh token
JSON Web Token
the token itself carries the claims and a signature, so you can verify it without a database lookup on every request.
A signed, self-contained token carrying claims that any holder of the key can verify locally. That statelessness is the whole appeal and the whole problem: verification needs no round trip, and neither does revocation, which therefore does not exist. Keep expiry short, pair with refresh tokens, and never put anything in the payload you would mind the client reading.
Full entry →Refresh token
you keep access tokens short-lived and hand over a longer-lived credential to get a new one when they expire.
A long-lived credential exchanged for new short-lived access tokens. It is what makes short expiry practical without asking the user to log in every fifteen minutes. Because it is long-lived it is the higher-value secret: store it server-side or in an httpOnly cookie, and rotate it on every use so theft is detectable.
Full entry →