refresh token behavior

[shortSparrow]

Hello dear Dave, In the authController.js you set cookie like res.cookie('jwt', newRefreshToken, { httpOnly: true, secure: true, sameSite: 'None', maxAge: 24 * 60 * 60 * 1000 }); But you don't specify Path, so refresh token will be send on every http request. Isn't this a problem? Doesn't this increase the risk that the token will be stolen?

And if you did it on purpose, why not add to verifyJWT an update of the access token if it expired. It would be better for the user, because he would update his token silently, and would not get any error

P.S. I am a beginner in backend, sorry if this question is silly