What is the correct refresh_token refresh strategy for multiple devices?

Question

JSON Web Token

I understand with JWT, in particular with refresh token'om. Can't think of a refresh token refresh strategy on multiple devices. If you store the token in the database and update it every time at the request of the client, then the devices will need to constantly go through the authentication process. On the other hand, if the token is not renewed, then if it is stolen or expires_in occurs, it will become invalid, which will entail the authentication process. Please tell me the correct refresh token refresh strategy using JWT for multiple devices. Thanks in advance!

Answer 1

Store the user ID and device ID in the token load. Upon receipt of an update request, check the token for validity, extract identifiers from it, search the database for a record for these identifiers and compare the token received from the database with the token from the user.