title: Java Spring JWT with refresh token workflow questions
body: <p>I have some questions regarding an  API JWT refresh token workflow using Java Spring. </p>
  
  <p><strong>I have this so far:</strong></p>
  
  <ol>
  <li>User logs in to /users/login - if successful a response with 2 headers is returned Authorization and Refresh. Which contain 2 tokens - one with short 30 mins  expiration and one with longer 4 hours expiration.</li>
  <li>He can then access all other endpoints using the Authorization header.</li>
  <li>If at some point accessing an endpoint his token is expired he receives an error (UNAUTHORIZED).</li>
  <li>And has to do a request to /token/refresh with the refresh token he was given.</li>
  </ol>
  
  <p><strong>Questions:</strong></p>
  
  <ul>
  <li>I have set it up so authorization token has a claim: type=auth and
  the refresh token has a claim: type=refresh. What is the best way to
  distinguish the two tokens. </li>
  <li>What should be the error in step 3 (instead of unauthorized) to distinguish it from a request without a valid token</li>
  <li>/token/refresh doesn't ask for authentication currently. Should it?</li>
  <li>Should the /token/refresh endpoint be a POST with header, POST with parameters or a GET with header.</li>
  </ul>