New refresh token with each login

[brendonanderson]

Issue description

I have gone through the JWT example and implemented it locally.

It seems with each authentication using the /login endpoint, a new refresh token is generated, which makes sense. But the table holding the refresh tokens continues to grow.

What is the recommended way to deal with these refresh tokens that seemingly will be around forever and continue to fill up table space?

[sdelamo]

I think that depends on application to application. You can have a single refresh token by user.

You can generated a TTL (Time To Live) for each refresh token and expire them with an scheduled job.

I have gone through the JWT example and implemented it locally.

Are you referring to the guide:

https://guides.micronaut.io/latest/micronaut-security-jwt-gradle-java.html

[brendonanderson]

Yes, that is the guide I was following.

There is likely a class that I can inherit from and override a method to check if the token already exists. I just need to find the right spot to do it.