DEV Community: Ajit Forger

Building Refreshing JWT Tokens in Node.js: A Complete Guide

Ajit Forger — Fri, 12 Sep 2025 20:09:41 +0000

When you’re building authentication in a Node.js application, JSON Web Tokens (JWTs) are one of the most common approaches. They’re fast, stateless, and easy to work with. But they also come with a catch: expiration. If you issue a short-lived token (say, 15 minutes), users get logged out too often. If you issue a long-lived token (say, 7 days), it increases security risks if the token leaks.

That’s where refresh tokens come in.

We’ll break down how JWT and refresh tokens work together, why you need them, and how to implement a secure refresh token strategy in Node.js.

🔑 What Are Refresh Tokens?

A JWT access token is used to authenticate requests. It’s short-lived, usually 10–30 minutes, to minimize risk.

A refresh token is a long-lived credential (days or weeks) that lets the client request a new access token without logging in again.

Access Token → Fast, stateless, expires quickly.
Refresh Token → Long-lived, securely stored, used only to renew access tokens.

🛠️ Project Setup

Let’s spin up a minimal Express.js app with JWT authentication and refresh tokens.

1. Install Dependencies

npm init -y
npm install express jsonwebtoken bcryptjs cookie-parser dotenv

express → Web framework
jsonwebtoken → For signing/verifying JWTs
bcryptjs → For password hashing
cookie-parser → To handle cookies (where refresh tokens can be stored)
dotenv → Manage environment variables

⚙️ Basic Server Setup

// server.js
const express = require("express");
const jwt = require("jsonwebtoken");
const bcrypt = require("bcryptjs");
const cookieParser = require("cookie-parser");
require("dotenv").config();

const app = express();
app.use(express.json());
app.use(cookieParser());

const PORT = process.env.PORT || 5000;
app.listen(PORT, () => console.log(`Server running on ${PORT}`));

🔐 Generating Tokens

We’ll need two token generators:

generateAccessToken(user) → short-lived (e.g., 15m)
generateRefreshToken(user) → long-lived (e.g., 7d)

function generateAccessToken(user) {
  return jwt.sign({ id: user.id, email: user.email }, process.env.ACCESS_SECRET, {
    expiresIn: "15m",
  });
}

function generateRefreshToken(user) {
  return jwt.sign({ id: user.id, email: user.email }, process.env.REFRESH_SECRET, {
    expiresIn: "7d",
  });
}

👤 Login Route

When a user logs in, we issue both tokens:

const users = []; // mock DB

app.post("/register", async (req, res) => {
  const { email, password } = req.body;
  const hashed = await bcrypt.hash(password, 10);
  users.push({ id: users.length + 1, email, password: hashed });
  res.json({ message: "User registered" });
});

app.post("/login", async (req, res) => {
  const { email, password } = req.body;
  const user = users.find(u => u.email === email);
  if (!user) return res.status(400).json({ error: "User not found" });

  const valid = await bcrypt.compare(password, user.password);
  if (!valid) return res.status(400).json({ error: "Invalid password" });

  const accessToken = generateAccessToken(user);
  const refreshToken = generateRefreshToken(user);

  // Store refresh token in HttpOnly cookie
  res.cookie("refreshToken", refreshToken, {
    httpOnly: true,
    secure: true, // enable in production (https)
    sameSite: "strict",
  });

  res.json({ accessToken });
});

🔄 Refreshing Tokens

Now, we add a /refresh endpoint to issue a new access token when the old one expires.

app.post("/refresh", (req, res) => {
  const token = req.cookies.refreshToken;
  if (!token) return res.status(401).json({ error: "No token provided" });

  jwt.verify(token, process.env.REFRESH_SECRET, (err, user) => {
    if (err) return res.status(403).json({ error: "Invalid token" });

    const newAccessToken = generateAccessToken(user);
    res.json({ accessToken: newAccessToken });
  });
});

🔒 Middleware to Protect Routes

function authMiddleware(req, res, next) {
  const authHeader = req.headers["authorization"];
  const token = authHeader && authHeader.split(" ")[1];
  if (!token) return res.sendStatus(401);

  jwt.verify(token, process.env.ACCESS_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
}

app.get("/protected", authMiddleware, (req, res) => {
  res.json({ message: "You are authorized!", user: req.user });
});

🚪 Logout

To log out, just clear the refresh token.

app.post("/logout", (req, res) => {
  res.clearCookie("refreshToken");
  res.json({ message: "Logged out" });
});

⚠️ Security Best Practices

Store access token in memory (not localStorage/sessionStorage).

Store refresh token in HttpOnly cookie → protects against XSS.

Rotate refresh tokens → issue a new refresh token each time it’s used.

Blacklist old refresh tokens if you want full control (store them in Redis or DB).

Use HTTPS in production to prevent token leaks.

🔄 Refreshing Tokens - Analogy

Here’s how it maps to frontend-backend requests:

Login:

Frontend sends your username/password.
Backend checks credentials and gives you:
- A short-lived access token (movie ticket)
- A long-lived refresh token (season pass, stored in an HttpOnly cookie).

Accessing protected routes:

Frontend attaches the access token in the request headers.
Backend verifies it. If valid → allows access.

Access token expires:

Frontend tries to make a request → gets 401 Unauthorized.
Frontend then calls /refresh without sending username/password, only letting the browser send the refresh token cookie automatically.

Backend verifies refresh token:

If valid → issues a new access token (new movie ticket).
If invalid/expired → user must log in again (season pass expired).

Key point:
The frontend never has direct access to the refresh token if you store it in an HttpOnly cookie. It just “trusts the browser” to send it along with /refresh requests. This keeps it safe from malicious scripts.

🎯 Conclusion

Using refresh tokens with JWTs balances security and usability. You get short-lived access tokens for protection and long-lived refresh tokens for convenience. In production, always handle refresh token storage carefully, implement rotation, and combine with HTTPS for a secure system.

This setup is scalable, works well with stateless services, and is widely used in modern authentication systems.

Understanding of CommonJS(Basics Node.js Series)

Ajit Forger — Wed, 08 Nov 2023 16:27:46 +0000

Hope you all are doing well,

In this micro article, we can understand what synchronous loading is, it's a basics concept of Node.js, which it's uses the Commons module systems.

So, before that, let's talk about CommonJs module systems.

CommonJS module systems

CommonJS modules are the module system for javascript programming language which is used in server-side and non-browser environments such as Node.js

CommonJs modules allow us to organize our code, make it reusable by its characteristics of encapsulation which is where we can make easier to manage and maintain large codebases.

Characteristics of CommonJs modules

Encapsulation

One of the key characteristics of CommonJs modules are it's encapsulation units
it's encapsulating the code and data, preventing them to interfere with other modules
This encapsulation is achieved by using of closures, which isolates the module scope

Exports and Require

Modules can export specific values, functions or objects so this way it can be available to other modules, by exports or module.exports object.

Synchronous Loading

CommonJS modules are loaded synchronously, to explain if a module required then, the entire modules and it's dependencies are loaded and executed before the program continues.

So, in this way programs executes by in order, order of execution

Conclusion

So, Thats its guys for now, Commons modules have more characteristics but for now we are cover some main characteristics, later we explore deep dive into their characteristics with examples to understand better.

Stay tuned for more advanced articles where we'll explore the depths of Node.js
If you have any queries or just want to share your Node.js anecdotes, and command below

happy coding! 🚀🐉💻

Node.js modules (Basics Node.js Series)

Ajit Forger — Wed, 08 Nov 2023 15:55:27 +0000

Nodejs modules are fundamentals concepts in the Node.js that enable you to organize and re-use code.

It's allowed you to break the code into smaller and manageable pieces.
Making easier to maintain and collaborate.
Modules helps you to encapsulate the code, so you can import and use it on other parts of your application.
Without creating a global variable or causing naming conflicts

it's very fundamental mostly used to create a clean structure of our projects.
we are using this CommonJS Modules lot in our Nodejs Projects
like creating a service

Eg, We can write a separate file for getting current currency conversion rates, get dates, day and mostly often for the configs, constants we can use these modules to store site configs constants etc...

*like for the constants *

LANG="en" CURRENCY="usd" BASEURL="yourbaseurl.com"

CommonJS Modules

Nodejs uses CommonJS module system, which defines a way to create, import and export modules.

CommonJS modules have two important main components.

You can export functions, variables or objects using modules.exports or exports object.

//Space.js

module.exports = {
   rocketFunction: function () {
      return "Rocket launched!";
   },
   Moon: 1
};

Importing Modules

You can import the exported content from another module using require function.

Const spaceFun = require(‘space.js’)

spaceFun.rocketFunction()

spaceFun.moon

Output

Rocket launched!
1

Another Example

Get export multiple modules.

// userInfo.js

// A function that greets the user with a personalized message
function greetUser(name) {
   return `Hello, ${name}! Welcome to my module.`;
}

// An object containing some module information
const moduleInfo = {
   moduleName: "My Node.js Module",
   author: "John Doe",
   description: "This is a simple Node.js module example.",
   version: "1.0.0"
};

// Exporting the greetUser function and moduleInfo object
module.exports = {
   greetUser,
   moduleInfo
};

Importing Modules

const userInfo = require('./info.js'); 

console.log(userInfo.greetUser("John")); 
// Output: "Hello, John! Welcome."

console.log(userInfo.moduleInfo); 
// Output: Object with module information

console.log(userInfo.moduleInfo.author); 
// Output: Get author value in module information Object it will outputs "John Doe"

Make use of, Another example

//shuffleArray.js
function shuffleArray(array) {
  for (let i = array.length - 1; i > 0; i--) {
    const j = Math.floor(Math.random() * (i + 1));
    [array[i], array[j]] = [array[j], array[i]];
  }
  return array;
}

module.exports = {
  shuffleArray,
};

Importing Module

const shuffleArray = require("./shuffleArray");

const colors = ["red", "green", "blue", "yellow", "purple"];

console.log("shuffleArray ", shuffleArray.mixArray(colors));

Output(may):
["green", "red", "blue", "purple", "yellow"]

So, That's were you can import the modules

Stay tuned for more advanced articles where we'll explore the depths of Node.js

If you have any queries or just want to share your Node.js anecdotes, and command below

happy coding! 🚀

Useful NPM scripts, Example usage(Basics Node.js Series)

Ajit Forger — Mon, 30 Oct 2023 12:32:42 +0000

Hi hello world, In this micro article we'll explore some essential NPM scripts that will help you kickstart your Node.js journey

As you embark on your journey to master Node.js

Managing your project, dependencies, and automating common tasks is an essential part of the process

NPM scripts are the initial and fundamental step to mastering Node.js, enabling you to streamline your development workflow and make your projects more efficient

An intro to the Npm scripts

Npm scripts in Node.js are a powerful and convenient way to automate various tasks
They are defined in "package.json" file under "scripts"

These scripts allow you to run a common development and build tasks with simple commands.

Example script definitions



"scripts": {
  "start": "node app.js",
  "test": "mocha test/*.js",
  "build": "webpack"
}

Here are some examples of useful NPM scripts you can include in your package.json file

1. Start your application

You can start your application by using npm start here's a basic example of how to start a script



"scripts": {
  "start": "node server.js"
}

2. Auto reloading with nodemon

Development server like Express.js and want it to restart whenever you make changes



"scripts": {
  "dev": "nodemon server.js"
}

3. Running tests

Testing framework like Mocha, you can set up a script for running tests.



"scripts": {
  "test": "mocha"
}

4. Linting our code

Using a linter like ESLint, you can create a script for code linting.



"scripts": {
  "lint": "eslint ."
}

5. Building your project(eg. webpack/babel)

Project requires a build step, such as transpiling or bundling, you can create a script for that (if needed)



"scripts": {
  "build": "webpack"
}

6. Running a custom task

You can define custom scripts for specific tasks, such as data migrations, or generating documentation



"scripts": {
  "migrate": "node db-migration.js",
  "generate-docs": "jsdoc --configure .jsdoc.json"
}

7. Run multiple scripts

At some point we might need to be run a multiple scripts, for that, use the concurrently package to run multiple scripts simultaneously.



"scripts": {
  "dev": "concurrently \"npm run server\" \"npm run client\"",
  "server": "nodemon server.js",
  "client": "webpack --watch"
}

8. Clean the build directory

If you have a build directory that you want to clean before rebuilding



"scripts": {
  "clean": "rm -rf dist",
  "build": "npm run clean && webpack"
}

Use npm run clean to remove the "dist" directory before running the build script.

Bouns (example script)

Custom report generation

If you need to generate custom reports or exports, you can create a script for that



// generate-report.js
const reportGenerator = require('./report-generator');

reportGenerator.generateReport()
    .then(() => {
        console.log('Report generated successfully.');
        process.exit(0);
    })
    .catch((error) => {
        console.error('Report generation failed:', error);
        process.exit(1);
    });

Calling the file



"scripts": {
   "generate-report": "node generate-report.js"
}

npm generate-report, command to run the script

Another Example (useful script), Currency converter

Get exchange rates using exchangeratesapi and using npm custom scripts to get exchange rates on command line

Create a new JavaScript file named currencyConverter.js
Install the axios package to make HTTP requests
Create an account on https://exchangeratesapi.io/ and replace the apikey



const axios = require("axios");

async function convertCurrency(amount, fromCurrency, toCurrency) {
  try {
    const response = await axios.get(
      `https://api.apilayer.com/exchangerates_data/latest?base=${fromCurrency}&symbols=${toCurrency}`,
      {
        headers: {
          Authorization: "Bearer [YOUR_API_KEY]",
        },
      }
    );

    const conversionRate = response.data.rates[toCurrency];
    if (!conversionRate) {
      console.log(
        `Currency conversion from ${fromCurrency} to ${toCurrency} is not supported.`
      );
      return;
    }

    const convertedAmount = amount * conversionRate;
    console.log(
      `${amount} ${fromCurrency} is equivalent to ${convertedAmount} ${toCurrency}`
    );
  } catch (error) {
    console.error("Error fetching exchange rates:", error.message);
  }
}

const args = process.argv.slice(2);
if (args.length !== 3) {
  console.log(
    "Usage: node currencyConverter.js <amount> <fromCurrency> <toCurrency>"
  );
  process.exit(1);
}

const amount = parseFloat(args[0]);
const fromCurrency = args[1].toUpperCase();
const toCurrency = args[2].toUpperCase();

convertCurrency(amount, fromCurrency, toCurrency);

In your package.json, add the script



"scripts": {
   "currency-convert": "node currencyConverter.js"
}

Now, you can run the currency conversion script using the npm run currency-convert

npm run currency-convert 560 INR USD

Conclusion

Now that you've dipped your toes into the whimsical world of NPM scripts, Stay tuned for more advanced articles where we'll explore the depths of Node.js

If you have any queries or just want to share your Node.js anecdotes, and command below

happy coding! 🚀🐉💻