title: What is the workflow for validating a refresh token and issuing a new bearer token?
body: <p>This is not a coding question, but a conceptual question for the correct handling and processing of a refresh token.</p>
  
  <p>I have a single page app which issues a jwt token when logging in. The token works just fine.  Now, I want to set the expiration to a low value, and use a refresh token to refresh the bearer token.</p>
  
  <p>The question is, what claims should be stored in the refresh token? And what steps are supposed to be done to validate the refresh token before issuing a new token?</p>
  
  <p>For example, right now my refresh token is a jwt which stores an expiration, so the client knows when the refresh token expires, and a username claim so that I know what user the refresh token is associated with.</p>
  
  <p>So then when the refresh token is recieved:</p>
  
  <ol>
  <li>Check that it is not expired.</li>
  <li>Check that it has not been revoked.</li>
  <li>Use the UserName in the refresh token to issue a new short-lived bearer token.</li>
  </ol>
  
  <p>Is this the correct workflow for this? I just want to make sure I am not missing any security checks.  </p>