search

auth0-blog / vue-jwt-authentication

MIT License
509 stars 112 forks source link

How to handle token refresh #9

Open nivv opened 8 years ago

nivv commented 8 years ago

It's my understanding that using the same token over and over opens up a window of attack, therefore the token should only be valid for a set amount of time.

It would be awesome if you could show an example of how to do that. Or am I overthinking things? Is it OK to have a token that expires after two weeks for example?

What are your thoughts?

chenkie commented 8 years ago

I'd recommend against token refreshing for single page apps in general. The problem is that if an attacker ever gets a hold of the refresh token, they can effectively stay logged in forever, or at least until you change your secret key.

The JWTs that Auth0 issues are valid for 10 hours by default. This is a good amount of time in my view. Sure your users will need to sign in every day, but keeping the validity period narrow like this helps security.

guillaumevincent commented 7 years ago

@chenkie normally refresh token is allowed during 1 week. So attacker can't refresh token "forever". And a token should be refreshed only if he is still valid.