Hello :sunny: I’d like this to be discussion of different approaches to keeping JWTs fresh, so authenticated requests aren’t failing due to expired tokens. I am hoping to find some examples of nice patterns that I can adopt for my own Elm applications, as I’ve already tried a few, but haven’t come…

I have a feeling the discussion I’ve proposed isn’t happening, and it’s probably because of my example. I’m unsubscribing from notifications now, and would appreciate if we can end it there. I’ll try to do this sort of thing differently next time! :slight_smile:

Worth taking a look at what ideas people had last time this came up: [image] Get refresh token and resend original request Learn I am using access- and refresh-token, and would like to send a request to get new tokens and then afterward send the original request, upon 401…

Your approach amounts to proactively refreshing JWTs based on setTimeout (Process.sleep) from Javascript AFAIK? [image] WindowOrWorkerGlobalScope.setTimeout() - Web APIs | MDN Does this work reliably? Have you experienced any hiccups when the device running your…

BTW, I was only linking the “Get refresh token and resend original request” topic as I though it might help to short-circuit having some of that conversation again - rather than proposing that my posts there are the solution. [image] opvasger: Does this work reliably? Have you experienced any h…

[image] rupert: BTW, I was only linking the “Get refresh token and resend original request” topic as I though it might help to short-circuit having some of that conversation again - rather than proposing that my posts there are the solution. Which is totally appropriate :slight_smile: Read th…

Hi, I’m confused: Assume you’re using a web-app where the JWT is expired , but can be refreshed: So you can refresh an expired token without any additional authentication? So what is the point of the token having an expiry then? I could see that maybe you want to keep open the option of expiring…

[image] allanderek: So you can refresh an expired token without any additional authentication? I am guessing he has 2 tokens, an auth token and a refresh token. The auth token might expire but the refresh token is still valid. An for some reason, a back-end that only lets you refresh after th…

In my case the api tokens expire, but new ones can be obtained using a secret (for server side apps that can keep a secret) I implemented it as a AWS Lambda task with Javascript, but when I had to start managing multiple callbacks - precisely because of this retry behavior - I tried rewriting in Elm…

We use short-lived tokens, 15 minutes. Tokens are issued with an associated UUID, which is present in claims as well as in the database. A user can refresh an expired token if it’s UUID matches the most recent issued token from authentication or refresh. Authentication and refresh overwrites this U…

One possible solution, might be to run a periodic timer of say 1 second. And re-check the current time vs token expiry time. Then if a device goes idle, it will re-check its token 1 second after waking up, and this could trigger a refresh. Of course, an HTTP request could easily happen in that 1 se…

[image] grigorious: I had issues with users with the correct time on their computers - but the wrong timezone - which meant checking current time against token expiration time always showed the token as expired - anyway one can not rely on the frontend to know the time. I didn’t mean to send …

How do you refresh JWTs in your Elm applications?

Learn

Topic		Replies	Views
Get refresh token and resend original request Learn	15	2645	May 3, 2020
How to gracefully handle HTTP responses indicating I need to refresh a token Learn	9	2266	May 29, 2018
OAuth2 Refresh token and Http Request Learn	7	1137	May 24, 2019
Security question - auth tokens in local storage? Learn	16	4160	June 9, 2020
Elm Jwt handling and potential security threats! Request Feedback	6	1421	September 10, 2020

How do you refresh JWTs in your Elm applications?

Related topics