graphql-express-template

In index.js at Line 29 of branch - https://github.com/benawad/graphql-express-template/tree/8_refresh_token: const addUser = async (req, res, next) => { const token = req.headers['x-token']; if (token) { try { const { user } = jwt.verify(token, SECRET); req.user = user; } catch (err) { const refreshToken = req.headers['x-refresh-token']; Here , consider a scenario if the tokens were compromised and one of them , lets say access token is now tampered , it will fail the verification and hence will enter the catch block and will generate a pair of new token. There should be an explicit check if the JWT verification fails and only if it is due to expiration of token then generate new pair of tokens.

Hi Ben. I hope you are ok in these days. i have a tiny problem with my school project. I want to make a user , post, comment with Graphql ,Express and Mongoose(Mongodb). I have wrote some code but i don't know why its not working. Can you please do me a favor and help me? I can create user but when i want to create a post related to the user i get this error in playground: these are my codes: TypeDefs: Resolvers: UserSchema: PostSchema: CommentSchema:

on L 33 of index.js you have logic like this if (!token) { return next(); } If the token were to expire in the client, the client will not send it along with the request meaning there is no token and refreshTokens would never be hit?