title: JWT access token vs refresh token (creating)
body: <p>I am creating a Asp.net Core REST service. Currently doing authentication via JWT bearer tokens.</p>
  
  <p>Right now, my code looks like:</p>
  
  <pre><code>        DateTimeOffset dtNow = DateTime.Now;
  
          Claim[] claims = new Claim[]
          {
              new Claim(JwtRegisteredClaimNames.Sub, strUsername),
              new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
              new Claim(JwtRegisteredClaimNames.Iat, dtNow.ToUnixTimeSeconds().ToString(), ClaimValueTypes.Integer64)
          };
  
          JwtSecurityToken jwtAccess = new JwtSecurityToken(_options.Issuer, _options.Audience, claims, dtNow.DateTime, dtNow.DateTime.Add(_options.AccessTokenExpiration),
                                                            _options.SigningCredentials);
  
          var response = new
          {
              access_token = new JwtSecurityTokenHandler().WriteToken(jwtAccess),
              token_type = "Bearer",
              expires_in = (int)_options.AccessTokenExpiration.TotalSeconds,
              refresh_token = ""
          };
  </code></pre>
  
  <p>Questions:</p>
  
  <ol>
  <li>Right now, my access tokens are good for 1hr and my refresh
  tokens for 60 days. Are these reasonable values?</li>
  <li>Not seeing much
  documentation on how to create the refresh_token... is this created
  <em>exactly</em> like the access token, but just with the different timeout?</li>
  <li>Its my understanding that I'm supposed to store the refresh token in a database and if the user sends a refresh token request, I need to verify the signature of the token AND make sure its in my database?</li>
  <li>When the user requests a refresh token, I'm supposed to return the same refresh_token whether its expired or not and let the user worry about getting a new one?</li>
  <li>A user should only have one refresh token at a time, correct? If they do another password_grant, I just overwrite the refresh token as if they are getting a brand new one?</li>
  <li>Final question is, I see people are doing JWT authentication which is why I'm doing it lol, but how is this any different then just sending a username / password over HTTPS? I understand that the JTW carries the state/roles/etc in the payload, so that saves a DB call, but since authentication tokens are short lived, they'd have to get a new token every 5 minutes, so this all seems kind of like a wash, unless I'm missing something?</li>
  </ol>