Hello! Nice to meet you guys. I was reading this article from 2020 https://supertokens.com/blog/are-you-using-jwts-for-user-sessions-in-the-correct-way and started the demo with react + python and I can say, really great job guys 😄 This is the first time i have such a good experience seeing how it works in 60 seconds. However, I have a question regarding the refresh token. The access token is a JWT. The refresh token is just a random string encrypted and saved in the session in db?

Hey @mihaiandrei that is correct.

Thank you! And, the refresh token is saved in the db encrypted? Or is it encrypted only in the access_token 😄

it's hashed in the db

Thank you

not necessarirly on the same domain

Oh, because the cookie is "lax" right?

yea

Thank you!