DEV Community

Refresh JWT with Refresh Tokens in Asp Net Core 5 Rest API Step by Step

Mohamad Lawand on January 25, 2021

Hello friends, In this article I will be showing you today How to add refresh tokens to our JWT authentication to our Asp.Net Core REST API Some...

Read full post

Walter Alvarez • Apr 13 '21

Hi Mohamad, Im using v8-refreshtokenswithJWT and when I trY to RefreshToken I have always Token has expired please re-login. This behavior succeds in line:

            var tokenInVerification = jwtTokenHandler.ValidateToken(tokenRequest.Token, _tokenValidationParams, out var validatedToken);

Then the software dont continue

Can you help me please. What can I do for fix it?

Thanks

Walter Alvarez • Apr 13 '21

The project works if I change ValidateLifetime to false

This is a good solution?

Thanks

Mohamad Lawand • Apr 13 '21 • Edited

Hi Walter, there is a small bug related to regeneration of the refresh token. I will push a fix for this within this week. We should always keep it to true

Walter Alvarez • Apr 13 '21

Thanks Mohamad

afagGit • Apr 27 '21

Hi Walter, hi Mohamad,

I'm still facing the same issue as described above. "jwtTokenHandler.ValidateToken" always throws an token expires exception. Is the bug fixed already?

Thank you and greetings.

Alex

Grand Silence • Apr 12 '21 • Edited

Some fixes for the article:

If you need lifetime of token less than 5 mins, add ClockSkew property in Startup.cs:

var tokenValidationParameters = new TokenValidationParameters {
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = new SymmetricSecurityKey(key),
    ValidateIssuer = false,
    ValidateAudience = false,
    ValidateLifetime = true,
    RequireExpirationTime = false,

    // Allow to use seconds for expiration of token
    // Required only when token lifetime less than 5 minutes
    // THIS ONE
    ClockSkew = TimeSpan.Zero
};

Don't forget to use UTC instead of local time. You will need to fix method GenerateJwtToken:

  var refreshToken = new RefreshToken(){
        JwtId = token.Id,
        IsUsed = false,
        UserId = user.Id,
        AddedDate = DateTime.UtcNow,
        // INVALID DATE, USE UTC
        // ExpiryDate = DateTime.Now.AddYears(1),

        // Now it's correct
        ExpiryDate = DateTime.UtcNow.AddYears(1),      
        IsRevoked = false,
        Token = RandomString(25) + Guid.NewGuid()
    };

Mohamad Lawand • Apr 13 '21

Thanks a lot Grand for these fixes, I am planning to add them this week.
If you want you can add a PR on the GitHub repo and I will merge them t

Bob Pokorny, MBA • Mar 9 '21

Hi Mohamad!

I have been following the currently 3-part series and continue to enjoy every video. I am currently experiencing a problem with the token not expiring and I think it is happening on Validation #3.

I'm finding that the expiryDate and DateTime.UtcNow values are too far apart to even expire. For example, at the time of running, my expiryDate value = '03/09/21 8:56:38 am' and my DateTime.UtcNow = '03/09/21 2:57:06 pm'.

I did end up using you exact code in GIT to make sure I'm getting the same results. Still no resolution. Then I started thinking, I am using zScaler to log into our network and wondering if that is having problems with date/time. However my expiryDate value is my local and accurate time.

Any ideas to why I cannot get my token to expire?
Thanks,
Bob

Mohamad Lawand • Mar 9 '21

Hi Bob,

Thank you for your feedback and comment, I will push an update to git repo to fix.

I apologise for the delay.

Lee Shaw • Mar 15 '21

Hi Mohamad, love the article!
Should the accessToken expire after 30 seconds? And when it does how is this handled? Using Swagger the token doesn't seem to be 401ing when i'm accessing the api/todo.
I have downloaded v8.
Thanks in advance.
Lee

Mohamad Lawand • Mar 15 '21

Hi Lee, I think you can configure the token to for 5 min and then it can expire and use the refresh token to get a new one. There is a bug in the code in V8. I will be pushing a fix this week for it

aVery_cat • Nov 11 '21

Hey I have a question, great tutorial btw, thanks for making it.
If user wants to refresh access token, it also gets new refresh token, shouldn't we just remove the old refresh token instead of marking it as used?

Mohamad Lawand • Nov 11 '21

For compliance reason you might keep them for a certain amount of time and then remove them.

Zujaj Misbah Khan • Jul 13 '21 • Edited

How did you define the ExpiryTimeFrame in JWTConfig model?
After the token expires, how would the automatic re-authentication take place when you're pointing to the login endpoint again?
Does it mean that we have to store the login info in our app? Please elaborate if i misunderstood.

wangzhe66369 • Apr 13 '21

Hi Mohamad!
I have a question, why use RefreshToken, it seems that only using Token can also refresh the token.
Thanks in advance.
Zhe

An T. NGUYEN • Apr 15 '21

Refresh token is similar to a backup key to get back new token in case it is expired or lost. You are sending the token over the internet many times so it "maybe" stolen.
That why we keep token expiration time is shorter a lot to the refresh token.

wangzhe66369 • Apr 16 '21

Thank you for your answer.
I understand that the purpose of JWT is to not store data on the server side. Now that the RefreshToken must be stored on the server side, does it violate the purpose of JWT? I feel that this approach is very similar to Session

candede • Jun 17 '21

hi Mohamad, thanks a lot for this series; truly great work.. I had an issue similar to some others where RefreshToken was not working since the token parameter validations enforce ValidateLifeTime and the only time you want to refresh the token after it's expired. So I have added another TokenValidationParams only to be used during Refresh Token creation and set the ValidateLifetime to false

var refreshTokenValidationParams = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(key),
ValidateIssuer = false,
ValidateAudience = false,
ValidateLifetime = false,
RequireExpirationTime = true
};

services.AddSingleton(refreshTokenValidationParams);

I've also updated the AuthManagementController constructor to call refreshTokenValidationParams

public AuthManagementController(UserManager userManager, IOptionsMonitor optionsMonitor, TokenValidationParameters refreshTokenValidationParams, BeanDataContext beanDataContext)

This fixed my issue but I dont know if this is the most elegant solution or a good solution at all. So I wanted to put here in the hope that someone will tell me if there is a better way of doing it. Thanks a lot for your time and efforts to put this series together

Mohamad Lawand • Jun 17 '21

Thank you very much for your feedback, maybe you can push your code to the repo and will review it there so other people will be able to benefit

Omid tavana • Aug 6 '21

tnx dear Muhmad. that was awesome

Muhammad Shahid Khan Afridi • Apr 3 '21

Hi Mohamad Lawand,
I did not find any Logout functionality here. can you please implement it or can you help via a comment for logout functionality in the same "AuthManagementController" controller?

Mehrdad Davoudi • Jun 21 '21

Hi Mohamad, Thank you for great article.
If you have time can you please add another part for 2fa authentication for web api.
there isn't any good article about that part. or I didn't find...

Mohamad Lawand • Jun 21 '21

Thank you for your kind feedback will add this topic to my list

Saeed • Apr 11 '22

Hello, I have a question about JWT, if the server can't store or remember the token after req, so how can the server check if the token sent by the client is valid or hasn't been modified