JWT Expiration vs. Embedded Refresh Token: Which Approach Yields Clearer Error Handling?
Goal Enforce least‑privilege access and gracefully handle expired JWTs in a Ktor 2.x application. Unresolved Decision When a request arrives with an expired access token, should the application: Option A: Rely on the JWT verifier’s built‑in exp validation, then perform a custom verify lambda that checks roles and optionally initiates a refresh flow via a sep