Contents
How do I handle JWT expiry?
The most common solution is to reduce the duration of the JWT and revoke the refresh token so that the user can’t generate a new JWT. With this setup, the JWT’s expiration duration is set to something short (5-10 minutes) and the refresh token is set to something long (2 weeks or 2 months).
How do I extend my JWT session?
To refresh the token, your API needs a new endpoint that receives a valid, not expired JWT and returns the same signed JWT with the new expiration field. Then the web application will store the token somewhere.
How do I make my JWT token not expire?
3 Answers
- retrieve the user info and Check whether the token is in his User database. If so allow.
- When user logs out, remove only this token from his user database.
- When user changes his password, remove all tokens from his user database and ask him to login again.
How long should JWT be valid?
The JWT access token is only valid for a finite period of time. Using an expired JWT will cause operations to fail. As you saw above, we are told how long a token is valid through expires_in. This value is normally 1200 seconds or 20 minutes.
Is there a way to expire a JWT?
If the user wishes to log out or expire existing tokens, they simply increment the jwt_version field. When generating a new JWT, encode the jwt_version into the JWT payload, optionally incrementing the value beforehand if the new JWT should replace all others.
How often should I refresh my JWT token?
Set the token expiration to one week and refresh the token every time the user opens the web application and every one hour. If a user doesn’t open the application for more than a week, they will have to login again and this is acceptable web application UX.
What’s the best way to revoke a JWT?
The most common solution is to reduce the duration of the JWT and revoke the refresh token so that the user can’t generate a new JWT. With this setup, the JWT’s expiration duration is set to something short (5-10 minutes) and the refresh token is set to something long (2 weeks or 2 months).
Do you need to ask the IDP if a JWT is valid?
Once you authenticate against an identity provider (IdP) and get back a JWT, you don’t need to ask the IdP if the JWT is valid. This is particularly powerful when you use RSA public/private key signing. The IdP signs the JWT using the private key and then any service that has the public key can verify the integrity of the JWT.