Question: how would you renew a token? #316

Activity

1. ziluvatar commented on Feb 22, 2017

   

   ziluvatar

   on Feb 22, 2017

   Contributor

   More actions

   @papaiatis some questions to understand context:

   • Login to backend which generates the JWT with 2h expiration. How do you login the user (ajax, full render)?
   • User plays around the website. What do you use the JWT token for? Does the frontend send it in each request to the backend? Is it only to be stored in the browser and check the time when the token expires?
2. ziluvatar

   added

   question

   on Feb 22, 2017
3. papaiatis commented on Feb 22, 2017

   

   papaiatis

   on Feb 22, 2017

   Author

   More actions

   @ziluvatar

   • User logs in through ajax, token is sent back with the response and stored in localStorage
   • Right now, the payload holds the roles of the user, so some of the pages, links, content are hidden when user does not have permission for it. The token is only sent once when the user logs in. (I guess that's the problem). The token expiration is checked each time the user initiates an ajax request back to the server.

   Thanks!

   👍React with 👍1Reacted by Alberto R.
4. ziluvatar commented on Feb 23, 2017

   

   ziluvatar

   on Feb 23, 2017

   Contributor

   More actions

   The token expiration is checked each time the user initiates an ajax request back to the server.

   Who checks that? frontend or backend?

   Frontend: You may not need that, just keep in your js code a "timer", it gets restarted/checked on every action (timer > exp - iat (or custom claim saying 2 hours) => force login)

   Backend: You would need to renew the token and send it back on each server action (cookie? header?)

   renew the token: maybe with something like: #172

   👍React with 👍1Reacted by Luis Custodio
5. papaiatis commented on Feb 23, 2017

   

   papaiatis

   on Feb 23, 2017

   Last edited by papaiatis

   Author

   More actions

   Who checks that? frontend or backend?

   Actually both. In frontend I'm using this module: https://github.com/auth0/angular2-jwt which checks the token on each request. In backend, I check it manually.

   Thanks for the tip, I'll take a look at the mentioned issue ASAP.
6. ziluvatar

   closed this as completedon Feb 27, 2017
7. papaiatis commented on Feb 27, 2017

   

   papaiatis

   on Feb 27, 2017

   Author

   More actions

   Sorry for the late reply. So I ended up creating a "renew token" API endpoint which I call when my angular 2 application starts up and then every 5 minutes. The server then returns me back a renewed token which I store in local storage.
8. ziluvatar commented on Mar 1, 2017

   

   ziluvatar

   on Mar 1, 2017

   Contributor

   More actions

   Thanks for letting us know your final solution!
9. anuragpathak2608 commented on Oct 10, 2019

   

   anuragpathak2608

   on Oct 10, 2019

   More actions

   @papaiatis
   @ziluvatar
   Requesting new token from client-side in your case Angularjs will cause swquirty issue.
   If your token gets leaked your application may get compromised completely.
   And if we provide the functionality to the client to request fresh token it will allow an attacker to use the token for an indefinite time. And this will make the exp value of 2hours in token useless.

   From security perspective, the token should be pushed from the server site instead of client-side to
   so that if your valid token gets leaked attacker can not use the same token for more than exp time here it is 2 hrs.

   I'm not sure how can we do it as it will conflict with the stateless property of JWT.