Popular posts

Tokens should never be stored anywhere. If your db is hacked, you are giving away all those accesses. A refresh token should also have an expiration time, only far longer than an access token.