How to generate - access token vs refresh token

Hey,

I have a problem in understanding on how to generate properly access token and refresh token. According to the docs there is a concept of both due to JWT_REFRESH_EXPIRATION_DELTA and JWT_EXPIRATION_DELTA configuration variables, but in the source files I’ve seen only single method for generating a token which is https://github.com/flavors/django-graphql-jwt/blob/master/graphql_jwt/shortcuts.py#L4

The flow which I would like to follow is:

1. User sign-up/sign-in to the app
2. User receives two tokens: access_token (valid for 5 minutes) and refresh_token (valid for 7 days)
3. The access_token is used to communicate frontend app with the backend API
4. The refresh_token is used to regenerate the access_token in intervals, so it would be valid during using the app in longer session

Is it correct approach to such scenario?

access_token = get_token(user)
refresh_token = get_token(user, exp=datetime.utcnow() + settings.JWT_REFRESH_EXPIRATION_DELTA)

[googol7]

What happens if I don’t call refreshToken after JWT_EXPIRATION_DELTA=minutes=5 but within JWT_REFRESH_EXPIRATION_DELTA=days=7? Will verifyToken(t) return false if JWT_VERIFY_EXPIRATION=true but refreshToken will return a new valid token? Or does JWT_VERIFY_EXPIRATION need to be turned off in order to refresh an expired token?

[tunarob]

1 question to this great explanation. How to keep the user logged in “forever” then? Well, forever as long as he keeps rehreshing within allowed JWT_EXPIRATION_DELTA time span (as I understand I’d refresh triggered after the time of 5 minutes in this case, token gets invalidated?)

I could set JWT_REFRESH_EXPIRATION_DELTA to be like 30 days but it’s still not forever.