Refresh Token example question about angular-jwt HOT 5 CLOSED

Hey there,

1. At what point or where is this local storage value set?

Hey that should be set by you when you do the Login with your Identity Provider. If you're using Auth0 for example, once the login process finishes, you should get back the refresh token and store it. Makes sense?

1. Is there a reason why a new token is generated instead of just sending the token bak with a new expiry date?

Generating a new token can be exactly that. If the server changes the Expire date, then the signature (red part from jwt.io) has to be regenerated and that means creating a new token. Does it make sense?

Thanks!

from angular-jwt.

Hey there @mgonto!

I am still a little confused, I am trying to achieve and understand what you coded live at ng-europe(very cool)

I thought that the token that the server generates would be:

localStorage.getItem('id_token');

And not:

localStorage.getItem('refresh_token');

And then the refresh token would be generated on request via a URL like "/api/v2/refresh_token"

from angular-jwt.

Hey there,

So id_token is the token you get after authentication and is the JWT that will be send in the header on every authenticated request.

The JWT returned in the id_token field can expire. If you want, your server can implement a refresh token mechanism. That means that when the user signs in, besides the id_token, you'll return the refresh_token. After that, you'll keep on using the id_token until it's expired. Once it expires, you'll use the refresh_token to call an endpoint that will return a new, not expired id_token to send again on every request. Does this make sense?

So, after the login process, if you're using a refresh_token, you'd actually save both the refresh_token and the id_token.

However, if you're using the refresh_token, it'll ALWAYS be returned when signing in, not in a separate request.

You can read more about refresh tokens in this documentation from Auth0 and in the auth0-angular docs

Let me know if this helps.

Cheers!

from angular-jwt.

@mgonto Why don't we just use id_token to validate the user and return a refreshed token? Even if a token is expired, we are still able to decode and validate the token.

from angular-jwt.

@kokujin
I am looking for a Refresh Token code example where did you find it?

from angular-jwt.