Refresh Tokens

In our case, a refresh token will just be a random 256-bit string. It's a token, but not a JSON Web Token. It doesn't need to be a JWT because we'll store it in our database and associate it with a user server-side. No point in using stateless JWTs if we're going to store them in a database anyway.

1. Create a new database table with up/down migrations called refresh_tokens.

   • token: the primary key - it's just a string

   • created_at

   • updated_at

   • user_id: foreign key that deletes the row if the user is deleted

   • expires_at: the timestamp when the token expires

   • revoked_at: the timestamp when the token was revoked (null if not revoked)

2. Add a func MakeRefreshToken() string function to your internal/auth package. It should use the following to generate a random 256-bit (32-byte) hex-encoded string:

   • rand.Read to generate 32 bytes (256 bits) of random data from the crypto/rand package (math/rand's Read function is deprecated).

   • hex.EncodeToString to convert the random data to a hex string

3. Update the POST /api/login endpoint to return a refresh token, as well as an access token:

   • Access tokens (JWTs) should expire after 1 hour. Expiration time is stored in the exp claim. You can remove the optional expires_in_seconds parameter from the endpoint.

   • Refresh tokens should expire after 60 days. Expiration time is stored in the database.

   • The revoked_at field should be null when the token is created.

   {
     "id": "5a47789c-a617-444a-8a80-b50359247804",
     "created_at": "2021-07-01T00:00:00Z",
     "updated_at": "2021-07-01T00:00:00Z",
     "email": "lane@example.com",
     "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
     "refresh_token": "56aa826d22baab4b5ec2cea41a59ecbba03e542aedbb31d9b80326ac8ffcfa2a"
   }

Run and submit the CLI tests.