Building Secure Session Management in NestJS - Refresh Tokens, Device Tracking & Session Revocation(PART 2)
typescript
dev.to
1. The Refresh Token Flow — Validating Against the DB This is where the real security upgrade happens. Instead of just verifying the JWT signature, we now check the database to confirm the session still exists and hasn't been revoked. // auth.service.ts — updated refreshToken method async refreshToken(rawRefreshToken: string) { // Step 1: Verify the JWT signature and check expiry. // jwtService.verify() throws an error if the token is expired or the signature is invalid. let p