Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

djboris's avatar

Passport and JWT refreshToken, multiple requests at once

We are using Laravel as the backend service for a GraphQL API, and on the frontend, we have a VueJS application. We started encountering a problem with the Passport's implementation of JWT when working with GraphQL (but the issue is applicable in the 'plain' REST as well).

Recently I learned that Passport contacts the DB every time it has to validate the token, just to check if the token is invalidated (when it is, the token ID gets deleted from the DB).

Now imagine this scenario:

  1. The user does some action on the app, which triggers multiple requests to the API.
  2. It turns out the authToken has expired, so the first request triggers the refresh process, and the others are queued in the Promise which is handling the refresh.
  3. The app receives the new authToken, and the queued requests get processed normally with the new token.

But, what if the user opens multiple links from the app in new tabs, at the moment when refreshing is due? What I get is this: the first tab that loads the app wins, the rest fails. Why? Well, all of the tabs will initiate the refreshing process, but the first that reaches the API will invalidate the refresh token, so the subsequent requests aiming to refresh the token will get the error of invalid refresh token.

Are there any ways to mitigate this, and at what side of the API? If I could just turn off authToken invalidation, that would be of great help, as I could proactively do the refreshing with a flag in local storage (for other tabs context).

My authToken expires in 15 minutes and refreshToken in 2 weeks.

0 likes
0 replies

Please or to participate in this conversation.