JWT (JSON Web Token) automatic prolongation of expiration

by

I work at Auth0 and I was involved in the design of the refresh token feature.

It all depends on the type of application and here is our recommended approach.

Web applications

A good pattern is to refresh the token before it expires.

Set the token expiration to one week and refresh the token every time the user opens the web application and every one hour. If a user doesn’t open the application for more than a week, they will have to login again and this is acceptable web application UX.

To refresh the token, your API needs a new endpoint that receives a valid, not expired JWT and returns the same signed JWT with the new expiration field. Then the web application will store the token somewhere.

Mobile/Native applications

Most native applications do login once and only once.

The idea is that the refresh token never expires and it can be exchanged always for a valid JWT.

The problem with a token that never expires is that never means never. What do you do if you lose your phone? So, it needs to be identifiable by the user somehow and the application needs to provide a way to revoke access. We decided to use the device’s name, e.g. “maryo’s iPad”. Then the user can go to the application and revoke access to “maryo’s iPad”.

Another approach is to revoke the refresh token on specific events. An interesting event is changing the password.

We believe that JWT is not useful for these use cases, so we use a random generated string and we store it on our side.

More Related Contents:

  1. Where to store JWT in browser? How to protect against CSRF?
  2. JWT refresh token flow
  3. Best practices for server-side handling of JWT tokens [closed]
  4. If you can decode JWT, how are they secure?
  5. What is token-based authentication?
  6. Authentication versus Authorization
  7. Non-random salt for password hashes
  8. Cross Domain Login – How to log a user in automatically when transferred from one domain to another
  9. Where do you store your salt strings?
  10. SPA best practices for authentication and session management
  11. Is it safe to put a jwt into the url as a query parameter of a GET request?
  12. How do I store and retrieve credentials from the Windows Vault credential manager?
  13. Symfony2 extending DefaultAuthenticationSuccessHandler
  14. Best way for a ‘forgot password’ implementation? [closed]
  15. What is the best Distributed Brute Force countermeasure? [closed]
  16. Should I hash the password before sending it to the server side?
  17. Should JWT be stored in localStorage or cookie? [duplicate]
  18. How to do stateless (session-less) & cookie-less authentication?
  19. Using Symfony2’s AccessDeniedHandlerInterface
  20. How to manually decrypt an ASP.NET Core Authentication cookie?
  21. Secure Google Cloud Functions http trigger with auth
  22. Google Authenticator available as a public service?
  23. What are best practices for securing the admin section of a website? [closed]
  24. Securing an API: SSL & HTTP Basic Authentication vs Signature
  25. is it bad to pass jwt token as part of url?
  26. Prevent PDF file from downloading and printing
  27. What’s the right OAuth 2.0 flow for a mobile app
  28. How to validate domain credentials?
  29. Moving old passwords to new hashing algorithm?
  30. Is it possible to reverse a SHA-1 hash?

Leave a Comment