Guide: JWT sessions

[pilcrowonpaper]

No description provided.

[jfagoagas]

@pilcrowonpaper I can contribute on this one if you're interested!

[Blackwidow-sudo]

I was just about to open a "Feature Request".

It would be great to have a guide on password authentication with access- and refresh-tokens, using JWT and describing how to securely do it.
Im currently considering switchting from sessions to token based authentication, but its kind of hard to get all the questions answered i have (especially security related questions).

A couple of questions i had while researching:

• Where should i store access-tokens and where should i store refresh-tokens, securely
• How to do refresh-token rotation
• How to invalidate tokens for user logout
• Should i read out the JWT on the client to determine when to request a new access-token with the refresh-token, or just do a "try access-token, else refresh and try again" method