Generaly, in Application, RefreshToken that Issued, is stored in redis or other db system.

Token is issued by encrypted(with private key in server). -> Annonymous user can’t decrypt token unless know private key

So I think that RefreshToken simply needs to go back and forth between the client and server in the header or cookie.

As additional explanation, I think time that simply check token that passed in header or cookie expired or not valid shorter than access time that access to redis or other db system to find refreshToken

Therefore i tried not save refershToken in server.

I only placed function for parse token.

    private Claims getTokenBody(String token, Key secret) {
        try {
            return Jwts.parserBuilder()
                    .setSigningKey(secret)
                    .build()
                    .parseClaimsJws(token)
                    .getBody();

        } catch (ExpiredJwtException e) {
            throw new TokenExpiredException();

        } catch (JwtException e) {
            throw new TokenNotValidException();
        }
    }

As a result, not occured error for Token ReIssue and Logout with token.

Could you please share your thoughts on this?
I would greatly value your opinion.