JWT 过期刷新太混乱？最简单的刷新策略与黑名单设计（时序图）

app.post('/auth/refresh', async (req, res) => {
  const rt = req.body.refresh_token;
  const inBlacklist = await redis.sismember('rt:blacklist', rt);
  if (inBlacklist) return res.status(401).json({ message: 'refresh token revoked' });

  // 校验rt合法性（省略）
  const newAccess = signAccess({ uid: req.user.id }, { expiresIn: '20m' });
  const newRefresh = signRefresh({ uid: req.user.id }, { expiresIn: '30d' });

  // 黑名单旧refresh
  await redis.sadd('rt:blacklist', rt);
  res.json({ access_token: newAccess, refresh_token: newRefresh });
});