4 ms·
Most systems use this method but over two tokens, usually referred to as a session/access token and a refresh token. See OAUTH.
by amaccuish 8y ago
Most systems use this method but over two tokens, usually referred to as a session/access token and a refresh token. See OAUTH.
- brokenwren 8y agoExactly. JWTs can't be extended since the signature is part of the JWT and signs the JSON body, where the expiration is.
- e12e 8y agoI'd think "extension" in this case means "hand in a jwt with expiration/renewal fields still valid, get a new jwt with extended expiration". Obviously the renewal service would need to be able to sign the new/extended token.