14

I am very new to JWT and I ended up inheriting a codebase which makes use of JWT. Now there are some very fundamental problems which I am facing and I am not finding any answers. This question is not code based so please bear with me.

Let us say that my JWT token is valid for 4 hours. Here are my requirements/constraints

  1. If a user is working at 3 hours 59 minutes. their session should get extended by 2 hours and they should not be required to re-enter credentials.

  2. The client side java script must not cache the user credentials in any way.

  3. It is OK to refresh the JWT token with a new one... but you must not do it on every request you make on the server. So the client has to be intelligent to refresh the JWT token when the time is right. You must not try to issue a new token on each and every request you make to the app, because we will end up in a scenario where we have 1000s of active tokens generated within the course of a session and all of them are active. this makes the signout requirement even harder.

  4. Once a user clicks signout. the JWT token should not be usable anymore. Even though its life time is still valid.

  5. If a signout occurs. All tokens which were issued (as part of session extension) should get invalidated. Not just the last one.

I am starting to read about JWT but it seems like my requirements cannot be met with JWT. these requirements are very easy to meet with the session id approach. but I don't want to give up on JWT just yet.

pedrofb
  • 37,271
  • 5
  • 94
  • 142
Knows Not Much
  • 30,395
  • 60
  • 197
  • 373

1 Answers1

14

JWT life extension

You can issue a JWT with the old one. Your client app have to request a new JWT when it is close to expiration time. Client knows the expiration time reading the exp claim and can invoke a refresh service to get a new token. If the client app is closed then the JWT will expire and it will be necessary for the user to present the credentials again

Logout

It is recommended to let tokens expire, but you can use a blacklist to store JWT that are still valid but can not be used for authentication:

  • When user clicks logout

  • After refreshing a ticket close to expiration time

You will need to add to JWT an unique identifier jti. The blacklist will contain jti and exp. Once current time > exp the entry can be discarded.

See Invalidating client side JWT session

Community
  • 1
  • 1
pedrofb
  • 37,271
  • 5
  • 94
  • 142