3 ms·
If you give the tokens an expiration time of 5 minutes, the application either needs to auto-request a token every 4-5 minutes automatically using a JavaScript
by rahkiin 10y ago
If you give the tokens an expiration time of 5 minutes, the application either needs to auto-request a token every 4-5 minutes automatically using a JavaScript timer, or your session times out way too quickly. If you close the tab, you will be logged out within 5 minutes. That may not be desired in many applications.
- mstade 10y agoYou don't have to use a timer, you can also do it when you're about to use the token, or after the token has been rejected if you're so inclined. I.e. before you make a request you check the validity of the token and if it's not valid you refresh it; or if you don't do this validation you'd have to deal with the server rejecting your token, doing the refresh, and then trying the original request again.
- vladgur 10y agoThat correct. You would use the timer to auto-refresh the token. Note: if you close the tab, if you use a session cookie for token storage, its likely to remain, but like you said will become invalid within 5 minutes. If you close the browser however, a Session cookie will be deleted, which mitigates an issue in a shared setting. Depending on the requirements, you can ask a user whether they are using a shared pc or a private pc and choose cookie storage at that point.