title: Security - JWT and Oauth2 (refresh token)
body: <p>I have a angular client app and a .net web api server.
  I'm trying to understand how to implement security in the best way using tokens.
  I thought about few options, and I don't know which one is the best, or if there is a better way.</p>
  
  <p>JWT with expiration</p>
  
  <p>1.User login with credentials -> Server returns a JWT with expiration (for example 60 minutes from login time). Each valid request to the server within this 60 minutes the server returns a new JWT token with a new expiration of 60 minutes. If user didn't send server request for 60 minutes he must login again. 
  This solution is very similiar to sessions.</p>
  
  <p>Oauth2 - I don't think I understand this protocol correctly, so I apologize if what I'm saying is not correct.</p>
  
  <p>2.User login with credentials -> user gets a refresh_token and access_token.
  For every request, the client attaches the access_token. If server returns 401 (unauthorized) the client uses the refresh_token to create a new access_token and re-send the failed request with the new token.</p>
  
  <p>The problem in this flow, for me, is that I don't know if I got unauthorized because the token was invalid or the user tried to access unauthorized resources.</p>
  
  <p>This led me to a third solution.</p>
  
  <p>3.User login with credentials -> user gets a refresh_token, access_token and access_token_expiration. When the user wants to create a request to the server, he checks if access_token has expired. If expired, the client will request a new access_token with new expiration and only then perfroms the request. </p>
  
  <p>And 2 more little question about auth2:</p>
  
  <p>1.Why do I have a refresh_token and access_token? Both of them are stored in client local storage. Why not to always use the refresh_token? For the server it makes sense to have a refresh_token and access_token since the refresh_token is secured.</p>
  
  <p>2.Does the refresh token have an expiration date? 
  If it does, how can I create a new refresh token?
  If it doesn't, isn't it a little unsave to give the ability to stay connected forever?</p>
  
  <p>Thank you very much for your help</p>