Most JWT refresh token implementations have a silent bug.
You delete the old token, then save the new one.
Two DB writes. Server crashes between them?
Old token is gone. New token is never saved.
The user is permanently logged out — no error, no log, nothing.
Here’s the fix 🧵
I hit all of this while building TaskFlow to practice “production‑grade” full‑stack work:
MERN + TS + Redux Toolkit + TanStack Query
- Stateless JWT auth with access/refresh, rotation, HttpOnly cookies
Rate‑limited auth routes, protected routes, dark mode, Docker, CI, etc
This also fixes a nasty race:
Two requests hit /auth/refresh with the same token:
naive: both read “valid”, both delete, both insert → one in, two out
fixed:
Mongo: second findOneAndUpdate → null → 401
Prisma: second delete has count === 0 → 401
Only one refresh wins.
Currently @bitsgoa has allowed for no exam policy if the student wishes for it and here we are being forced , this is truly unjust to more than 30000 students of this university, all they care about is reputation and money , nothing else. - 4
@ugc_india@PMOIndia@SRM_Univ