Contents
Why do JWTs expire?
If a JWT is stolen, then the thief can can keep using the JWT. An API that accepts JWTs does an independent verification without depending on the JWT source so the API server has no way of knowing if this was a stolen token! This is why JWTs have an expiry value. And these values are kept short.
What happens when JWT expires?
The JWT access token is only valid for a finite period of time. Using an expired JWT will cause operations to fail. As you saw above, we are told how long a token is valid through expires_in. This value is normally 1200 seconds or 20 minutes.
Why are JWT short lived?
They’re designed to be short-lived with refresh capabilities. Conceptually, the token would be refreshed in the server when a request is made. The server would check how long the JWT has left and if within a configured timeframe, would refresh and deliver it back to the client.
How do you handle expired JWT?
There are three ways:
- Changing the secret key. This will revoke all tokens of all users, which is not acceptable.
- Make each user has his own secret and just change the secret of a specified user. Now the RESTful backend is not stateless anymore.
- Store the revoked JWT tokens in Redis.
How to reduce the duration of a JWT?
Reduce the duration of the JWT. The most common solution is to reduce the duration of the JWT and revoke the refresh token so that the user can’t generate a new JWT. With this setup, the JWT’s expiration duration is set to something short (5-10 minutes) and the refresh token is set to something long (2 weeks or 2 months).
What do you need to know about JWTs?
A JWT is a structured security token format used to encode JSON data. The main reason to use JWT is to exchange JSON data in a way that can be cryptographically verified. There are two types of JWTs:
When to revoke a JWT on fusionauth?
With this setup, the JWT’s expiration duration is set to something short (5-10 minutes) and the refresh token is set to something long (2 weeks or 2 months). At any time, an administrator can revoke the refresh token which means that the user must re-authenticate to get a new JWT. That is unless they happen to have a valid JWT.
Why are JWTs more flexible than opaque tokens?
5) Myth: JWTs are more flexible: Flexibility comes because we can put anything in a JWT. However, we can do the same with opaque tokens. Any data can be stored in the database against an issued opaque access token.