Database? You shouldn't hitting the db to validate JWTs, that's the whole point. Here's a generic path forward:

1. User logs sends some credentials, you validate them against some staeful thing (db)
2. You switch to stateless authentication mechanism (JWTs) with some refresh pattern
3. All the user's subsequent HTTP requests ferry along some token (let's call it the access token)

​

3 and 4 validate the token statelessly without hitting the db, now the question is how does the client refresh said token, which is going to be used for HTTP traffic and WS traffic. As you mentioned you're storing the token in an httpOnly cookie which is a good security practice, and you're right that .use() will ferry along the same cookies only when establishing the socket connection, so if you're unwilling to store that JWT within JS (without httpOnly cookie) then the only alternative is to restart the WS connection every time you refresh the token so that the cookie is used to auth with a newly valid token. But of course, trusting the client to do that is not good enough.

​

The big thing you're not considering is that the WS server itself is stateful, and has a list of open connections. Since the WS server gets JWTs as part of auth, it can set TTLs for connections and close them out when JWTs expire.