Added API endpoint for token refresh #172

jppellerin · 2016-02-03T16:14:08Z

According to issue #122, there was some interest in having an endpoint to refresh a token.

A refresh is considered to have the same token returned, but with a later expiry time.

This function takes in a decoded token, copies the attributes of this token over, and with that data, proceeds to signing a new token. The only piece of data that is replaced is the expiresIn value, which is passed in the function parameters. By extension, the iat value is also changed since a new token is created.

…e {complete: true} option is on

…omplete: true}

…dpoint to refresh a token. A refresh is considered to have the same token returned, but with a later expiry time. Can take into account the header + payload of a decoded token ie : {complete: true} More in depth testing with comparision of equality Testing failures and async mode Added description for refresh in README.md

…onwebtoken into refresh-token

Kiura · 2016-02-04T17:34:14Z

+1

matthewchung74 · 2016-02-09T00:12:03Z

+1

jfromaniello · 2016-02-16T12:32:09Z

Very nice job, I will merge this!

jppellerin · 2016-02-16T13:07:49Z

👍 Excellent! Thank you!

mateeyow · 2016-03-03T01:37:59Z

Quick question, when will this be merged? Any ETA?

pmeijer · 2016-03-09T22:28:03Z

+1

arturskeeled · 2016-03-17T11:46:08Z

+1 Any news on when is this being implemented?

jppellerin · 2016-03-17T13:10:53Z

@mateeyow @arturskeeled I'm not sure when the next major release will be coming out, but I have just updated my forked version with the refresh endpoint : https://github.com/jppellerin/node-jsonwebtoken. You could use this for development purposes.

Disclaimer: I have not tested the merge thoroughly..

rickli1989 · 2016-04-08T00:27:28Z

Waiting for this to get released

rickli1989 · 2016-04-15T02:38:33Z

When is the next major release for this ?

RWOverdijk · 2016-05-03T13:59:21Z

👍 we'd really like to implement refresh tokens.

VMBindraban · 2016-05-12T07:23:15Z

Any ETA yet?

RWOverdijk · 2016-05-25T12:51:42Z

Bump...

RWOverdijk · 2016-06-22T14:22:47Z

Last bump. I don't want to fork but I really need this.

jppellerin · 2016-06-22T14:49:11Z

@RWOverdijk : I have just updated my fork with the newest version and fixed the tests.
https://github.com/jppellerin/node-jsonwebtoken

I can keep this up to date with the newest features here until it gets merged in. If you want some assurances, I can tag you a version.

That's the best I can do.

Tchikita35 · 2016-07-09T07:27:12Z

README.md

@@ -172,6 +172,28 @@ console.log(decoded.header);
 console.log(decoded.payload)
 ```

+### jwt.refresh(token, expiresIn, secretOrPrivateKey [, callback])
+
+Will refresh the given token.  The token is __expected__ to be *decoded* and *valid*. No checks will be performed on the token.  The function will copy the values of the token, give it a new expiry time based on the given `expiresIn` parameter and will return a new signed token using the `sign` function and given secretOrPrivateKey.


⭐⭐⭐⭐⭐

mitchellporter · 2016-07-24T01:07:46Z

Is there a reason this hasn't been merged yet?

morgondag · 2016-07-27T13:11:49Z

forking is the place.

Isaac6702 · 2016-07-28T16:29:19Z

Now you can use this?

jfromaniello · 2016-07-29T19:02:03Z

I am still considering this feature, I think as it is it doesn't add too much value over sign and it creates another api to maintain and another source for confusion and vulnerabilities. I refresh should also validate the token it would be more like a verify->sign.

jppellerin · 2016-07-29T19:12:57Z

@jfromaniello Thanks for the feedback. The goal (for what we are using it for) is to extract all fields of a token and return it with a new exp. The only way (as far as I know) is to create a new one.

I didn't include verification since the token needs to be decoded for this to work. Therefore, it assumes the user has manipulated this - thus it would be safe to assume that it has been validated.

I agree that if one uses this API the wrong way and refreshes a non-valid JWT, then a valid one will be returned, which has cause for concern.

The value this endpoint has is to save the logic of copying over the fields of the existing token and re-signing it. I can agree with you that it is not something extremely difficult to do, but is something that is useful and that many people are using (or so it seems by the interest of this pull request). I would assume that this is going to be more and more common as people are moving towards serverless architectures/completely stateless.

All that being said: I think that verification would be a good idea. I also think it is a useful endpoint (I may be biased since I'm using this).

…sts needed

AlexanVal · 2017-03-04T12:38:08Z

README.md

+```js
+// ...
+var originalDecoded = jwt.decode(token, {complete: true});
+var refreshed = jwt.refresh(originalDecoded, 3600, secret);


I think it should be var refreshed = jwt.refresh(**token**, 3600, secret);

I don't see the point of this. You have to decode and validate it, and you will have the payload, why not just call sign on that payload instead of having a refresh function that will decode it again?

jppellerin · 2017-04-27T18:19:55Z

@jfromaniello Maybe this pull request should be rejected if it's not going to be merged? It has been over a year now.

omar-haris · 2017-05-22T06:04:08Z

@jppellerin can you give me an example to use it ?

natealcedo · 2017-05-23T12:13:11Z

Whats the update on this pull request? It's been over a year. I agree with @jppellerin that it should either get merged if not rejected. @jppellerin Have you considered making a fork of this and pushing to npm?

jppellerin · 2017-05-23T20:48:19Z

@fiftysoft : An example is in the readme docs of the pull request.

@ndaljr : I have considered making a fork, but the problem is keeping up with the rest of the library. I don't want to have the code duplicated and potentially falling behind on updates. If this was to become it's own module, it would have to only extend it. Which, I might put some thought into this.

oshalygin · 2017-06-30T18:50:50Z

Any status on this?

fiddur · 2017-07-14T11:59:08Z

Fixed by documentation: #371

VMBindraban · 2017-07-14T12:07:01Z

Well this feels like a big slap in the face for the people who were waiting for it.

fiddur · 2017-07-14T12:22:00Z

@VMBindraban: Since you still had to decode and validate it before using the refresh function, that function added very little value over just deleting old exp/iat and using sign instead.

Keeping the API and the code clean and small without unnecessary complexity is more important than a convenience method that is hardly even convenient.

BrOrlandi · 2017-07-26T03:36:17Z

I have found a problem in the refresh function that's causing it to generate the same token.
In the file refresh.js line 102
the token.iat is trying to read a property that doesn't exist because token is a string.
Even using payload.iat, the code allows passing the iat in payload, which causes the jwt.sign() generates the same token. The solution I found is to remove the iat from payload. Anyone had this problem?

deepakchandola717 · 2020-05-21T18:09:04Z

What if the original token gets stolen?
Anyone with the expired token can refresh it?

RWOverdijk · 2020-05-22T15:26:11Z

Then you call the police. Theft is not okay.

deepakchandola717 · 2020-05-22T15:38:29Z

I mean this feature could pose a security issue if any app is using it. There's no point in making it expire only in first place.

RWOverdijk · 2020-05-22T15:40:33Z

You're commenting on an issue from 2016 dude.

But to answer your question: every form of session/auth has the same issue. Cookies: get the token. JWT: get the token. oauth: get the token.

Just make it really really difficult to steal the token. 😄

deepakchandola717 · 2020-05-22T16:53:37Z

Ok you just think why do we set an expiry to the token in first place and why do we have two different types of token.
Make it really really really difficult to steal, never let it expire and hope you did everything right 😂

deepakchandola717 · 2020-05-22T16:55:32Z

This is a very old issue and every one was asking why feature wasn't merged. Thought this could be a reason.

Jean-Philipe Pellerin added 10 commits February 2, 2016 09:21

Initial work done. Writing basic tests. Need to look at different cases

bebaf16

Refresh works, but only when just the payload is decoded, not when th…

10f2f9f

…e {complete: true} option is on

Can take into account the header + payload of a decoded token ie : {c…

8c81d34

…omplete: true}

More in depth testing with comparision of equality

5d8d288

typos in test and documentation in index.js

0428b23

Testing failures and async mode

9bd0961

Added description for refresh in README.md

3286e3c

Merge branch 'refresh-token' of https://github.com/jppellerin/node-js…

c1e4217

…onwebtoken into refresh-token

Fix of => (arrow function) for function definition - not supported

e122e2e

jppellerin mentioned this pull request Feb 4, 2016

Refresh token #122

Closed

jfromaniello added the next-major label Feb 16, 2016

Merge branch 'refresh-token'

27c0eb0

Jean-Philipe Pellerin added 2 commits June 22, 2016 10:34

Merge remote-tracking branch 'upstream/master'

ed9d449

Fixing for changes in naming from version 6.0.0

e4bc232

Tchikita35 reviewed Jul 9, 2016
View reviewed changes

Jean-Philipe Pellerin added 2 commits July 29, 2016 15:17

Merge branch 'master' of https://github.com/auth0/node-jsonwebtoken

063779b

Refresh refactored and now verifies that the token is valid - more te…

5f11be4

…sts needed

ziluvatar mentioned this pull request Feb 23, 2017

Question: how would you renew a token? #316

Closed

AlexanVal reviewed Mar 4, 2017

View reviewed changes

fiddur mentioned this pull request Jul 14, 2017

docs: about refreshing tokens #371

Merged

fiddur closed this Jul 14, 2017

Amri91 mentioned this pull request Dec 29, 2017

init Amri91/authomatic#2

Merged

derrickmehaffy mentioned this pull request Aug 1, 2018

Refresh JWT route strapi/strapi#1676

Closed

leocouderc mentioned this pull request Jul 2, 2020

Token low security issue salimkanoun/Orthanc-Tools-JS#244

Closed

Added API endpoint for token refresh #172

Added API endpoint for token refresh #172

Conversation

jppellerin commented Feb 3, 2016

Kiura commented Feb 4, 2016

matthewchung74 commented Feb 9, 2016

jfromaniello commented Feb 16, 2016

jppellerin commented Feb 16, 2016

mateeyow commented Mar 3, 2016

pmeijer commented Mar 9, 2016

arturskeeled commented Mar 17, 2016

jppellerin commented Mar 17, 2016

rickli1989 commented Apr 8, 2016

rickli1989 commented Apr 15, 2016

RWOverdijk commented May 3, 2016

VMBindraban commented May 12, 2016

RWOverdijk commented May 25, 2016

RWOverdijk commented Jun 22, 2016

jppellerin commented Jun 22, 2016

Tchikita35 Jul 9, 2016

Choose a reason for hiding this comment

mitchellporter commented Jul 24, 2016

morgondag commented Jul 27, 2016

Isaac6702 commented Jul 28, 2016

jfromaniello commented Jul 29, 2016

jppellerin commented Jul 29, 2016

AlexanVal Mar 4, 2017

Choose a reason for hiding this comment

fiddur Jul 14, 2017

Choose a reason for hiding this comment

jppellerin commented Apr 27, 2017

omar-haris commented May 22, 2017

natealcedo commented May 23, 2017

jppellerin commented May 23, 2017

oshalygin commented Jun 30, 2017

fiddur commented Jul 14, 2017

VMBindraban commented Jul 14, 2017 • edited Loading

fiddur commented Jul 14, 2017

BrOrlandi commented Jul 26, 2017

deepakchandola717 commented May 21, 2020 • edited Loading

RWOverdijk commented May 22, 2020

deepakchandola717 commented May 22, 2020

RWOverdijk commented May 22, 2020

deepakchandola717 commented May 22, 2020

deepakchandola717 commented May 22, 2020

VMBindraban commented Jul 14, 2017 •

edited

Loading

deepakchandola717 commented May 21, 2020 •

edited

Loading