It's time...
The basic implementation:
- new DB table to hold users' refresh tokens
- a new endpoint to get a new auth_token from an existing refresh token
- rotation - upon use, a new refresh token is returned - allowing tracking of potentially stolen tokens
- will continue to use itsdangerous as serializer (e.g. these aren't JWTs)
- some options for how to cleanup old/expired refresh tokens
It's time...
The basic implementation: