How is token storage implemented in your latest project?

In my latest Java project, a JWT (JSON Web Tokens) approach was used for storing authentication tokens, where the token itself was not stored on the server but verified by its signature.

However, for refresh tokens and sessions, storage in a database (PostgreSQL) was employed with a table containing:

• Token identifier
• User ID
• Creation and expiration times
• Status (active/revoked)

This allowed for effective session management and token revocation when necessary.

An example table structure:

CREATE TABLE refresh_tokens (
    token_id SERIAL PRIMARY KEY,
    user_id INT NOT NULL,
    token VARCHAR(512) NOT NULL,
    created_at TIMESTAMP NOT NULL,
    expires_at TIMESTAMP NOT NULL,
    revoked BOOLEAN DEFAULT FALSE
);

In the application, upon authentication, a new refresh token was created and stored in this table. When requesting an access token refresh, the presence and status of the refresh token in the database were checked.