api - JWT (JSON Web Token) automatic prolongation of expiration -



api - JWT (JSON Web Token) automatic prolongation of expiration -

i implement jwt-based authentication our new rest api. since expiration set in token, possible automatically prolong it? don't want users need sign in after every x minutes if actively using application in period. huge ux fail.

but prolonging expiration creates new token (and old 1 still valid until expires). , generating new token after each request sounds silly me. sounds security issue when more 1 token valid @ same time. of course of study invalidate old used 1 using blacklist need store tokens. , 1 of benefits of jwt no storage.

i found how auth0 solved it. utilize not jwt token refresh token: https://docs.auth0.com/refresh-token

but again, implement (without auth0) i'd need store refresh tokens , maintain expiration. real benefit then? why not have 1 token (not jwt) , maintain expiration on server?

are there other options? using jwt not suited scenario?

i work @ auth0 , involved in design of refresh token feature.

it depends on type of application , here our recommended approach.

web applications

a pattern refresh token before expires.

set token expiration 1 week , refresh token every time user open web application , every 1 hour. if user doesn't open application more week, have login 1 time again , acceptable web application ux.

to refresh token api needs new endpoint receives valid, not expired jwt , returns same signed jwt new expiration field. web application store token somewhere.

mobile/native applications

most native applications login 1 time , once.

the thought refresh token never expires , can exchanged valid jwt.

the problem token never expired never means never. do if lose phone? so, needs identificable user somehow , application needs provide way revoke access. decided utilize device's name, e.g. "maryo's ipad". user can go application , revoke access "maryo's ipad".

another approach revoke refresh token on specific events. interesting event changing password.

we believe jwt not useful these utilize cases utilize random generated string , store on our side.

api security rest authentication jwt

Comments

Post a Comment

Popular posts from this blog

Delphi change the assembly code of a running process -

Delphi change the assembly code of a running process - i'm trying alter address 00741fa5 has push test.009e721c . alter push test.009e71c8 . procedure callback; asm force $9e71c8 end; procedure tform2.btn1click(sender: tobject); var ppid :dword; pprocess : cardinal; begin getwindowthreadprocessid(findwindow(nil,pchar('test')), @ppid); pprocess := openprocess(process_all_access, false, ppid); injectasm(pprocess, $741fa5, 10, integer(@callback), 0); end; here injectasm function (with error checking) function injectasm(process: longword; injectaddress, injectsize, codeaddress, codesize : integer): pointer; var csize, rsize : integer; replaced : array of byte; jmp : array [0..4] of byte; jmpaddress : integer; nopv : byte; : integer; nbr: ulong_ptr; begin //injectsize must equal or greater 5, because need space our //(far) jmp wwxxyyzz instruction //if there's no space, inject in place of few instructions if injectsize ...
Read more

json - Hibernate and Jackson (java.lang.IllegalStateException: Cannot call sendError() after the response has been committed) -

json - Hibernate and Jackson (java.lang.IllegalStateException: Cannot call sendError() after the response has been committed) - hello have problem hibernate , jackson. have 2 pojos @entity @table(name = "users") public class user implements serializable { static final long serialversionuid = 4235637833262722256l; @id @generatedvalue private int id; @column(name = "creation_date") private date creationdate; @column(name = "first_name") private string firstname; @column(name = "last_name") private string lastname; @version @column(name = "version") private int version; @column(name = "e_mail") private string email; @column(name = "enabled") private boolean enabled; @column(name = "login") private string login; @column(name = "password") private string password; @jsonmanagedreference("role") @onetomany(mappedby = "user", cascade = cascadetype.all,fetch = fetchtyp...
Read more

C++ 11 "class" keyword -

C++ 11 "class" keyword - i've started using c++ 11 little bit more , have few questions on special uses of class keyword. know it's used declare class, there's 2 instances have seen don't understand: method<class t>(); and class class_name *var; why precede typename keyword class in first example, , keyword pointer in sec example? that known elaborated type specifier , necessary when class name "shadowed" or "hidden" , need explicit. class t { }; // love of god don't t t; t t2; if compiler smart, give these warnings: main.cpp:15:5: error: must utilize 'class' tag refer type 't' in scope t t2; ^ class main.cpp:14:7: note: class 't' hidden non-type declaration of 't' here t t; ^ if class not defined, deed forwards declaration. for example: template <typename t> void method() { using type = typename t::value_type; } method...
Read more