JWT Multiple Request Refresh Token

A way to solve this issue would be to synchronise around refresh API calls. This way, parallel refresh calls will never happen, and in fact, you need to even do the 2nd onwards refresh call. The trickiest part here is to also lock across tabs, since the user could have several tabs of your website open and all of them running in parallel.

This is exactly what SuperTokens.io does in their website SDK. As a user, you don't need to worry about this and can simply make your fetch / axios calls as usual.

Seems like a lot of work where a simple session id would suffice. JWT’s are not the appropriate solution where session-like behavior is wanted.