Expiry in JWT authentication

Question

I am developing an angular app which currently has authentication with cookies and session. But I want to use jwt authentication.

And I have a doubt that if that token is stolen then the complete authentication is stolen?

And If there is no expiry date is that a risk?

Because if I login in my computer then the token always resides in the browsers local storage and if anyone steals that token from my computer, they have the access to my account. Then how is it a secure authentication

Please help me in understanding the risks and the way this works.

Thank you

Store your token in cookies, and give the cookie a expiry date or expire cookie on exit. — Ataur Rahim Chowdhury
– Ataur Rahim Chowdhury, Commented Apr 2, 2016 at 3:09

Spomky-Labs · Accepted Answer · 2016-05-02 06:08:08Z

Yes, in the absence of the exp (expiration time) claim and if your token is stolen, you will have a serious security problem. This can be mitigated by the audience if a jti (token ID) claim is set, but necessitate a storage (e.g. database, and filesystem...) with all revoked jti.

As per OpenID Connect Core Specification, ID Token must have an exp with usually no more than a few minutes. I think that all authentication providers that use JWT should follow this requirement.

Collectives™ on Stack Overflow

Expiry in JWT authentication

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related