Refresh Token Jsonwebtoken

Question

I am using jsonwebtoken in NodeJs API application for authenticating user in my API application. The flow that I have setup is as follows:

1) The user registers through signup API and the access token is generated using the following:

var jwt = require('jsonwebtoken');
var token = jwt.sign(user, _conf.authentication.superSecret, {
    expiresIn: 1440 // I intend to keep it short.
});

2) The token expires in 24 hours for example. This token is returned to the client mobile application to use as header in all the subsequent API requests.

I want to know how do I work around with refresh token for jwt. Currently I don't have a mechanism for refreshing token. Hence if the token expires in 24 hours I want the client (mobile app) to be able to request a new access token. Thanks in advance.

Have a look at my post here: http://stackoverflow.com/questions/38766688/understanding-json-web-token-jwt-in-context-of-web-authentication It explains a setup using refresh tokens. — B M, Aug 06 '16 at 12:15

score 37 · Accepted Answer · edited Mar 02 '19 at 10:18

37

I had same problem in a project.

1) I created the refresh token and returned it when user signed in (with the jsonwebtoken). I saved the refresh token with the user.

2) When client send a request with the expired token, server returns 401.

3) I implemented a new path to refresh the token. It receives the refresh token and the user as param and returns a new token (jsonwebtoken).

4) (optional) You can implement a mechanism for invalidating a refresh token, in case someone stole it

I based my implementation in this post, really good snippets:

Refresh token in JWT (Node.js implementation)

Hope it helps

edited Mar 02 '19 at 10:18

Vladyslav Zavalykhatko

15,202
8
65
100

answered Nov 21 '16 at 10:05

David Vicente

3,091
1
17
27

Let me know if you need some help or anything – David Vicente Jun 01 '17 at 08:20
1

https://solidgeargroup.com/refresh-token-autenticacion-jwt-implementacion-nodejs this site can't be reached – Erick Cortorreal Mar 21 '18 at 15:41
4

is there any github repo for this answer? – dennbagas Sep 30 '19 at 06:12
@dennbagas could you do it in that way? – jecorrales May 07 '20 at 05:38
The link is dead. It seems to have moved [here](https://www.izertis.com/en/-/refresh-token-with-jwt-authentication-in-node-js). – callmekatootie Mar 06 '22 at 18:31

Refresh Token Jsonwebtoken

1 Answers1

Linked