CODEWITHSUNDEEP
authenticationjwt
Gregory-Turtle
Gregory-Turtle

Reputation: 1717

What is the correct workflow for JWT?

I am working on an API and I am trying to wrap my head around authorization. I just learned about JSON Web Tokens and I understand the concept but there a few things I have questions about.

  1. Once I get the initial JWT, do I just include it in the header whenever I make a request from the client to the server?
  2. Do I also include it when responding to the client from the server?
  3. Do I have to update the expiration time whenever I send it with a request (in either direction)?

Thank you!

Upvotes: 3

Views: 1721

Answers (1)

eckymad
eckymad

Reputation: 1080

  1. If you need to be able to authenticate the request, yes you will need to send the JWT with the request. Calls that do not need authentication can be made without this.
  2. No, you don't need to include it in every response. Once the browser has the JWT assigned (at login), you can just store it in the browser (localstorage) until it should be adjusted or removed (such as logging out)
  3. The expiration should be set so that the token remains valid for the period you need it for. Just like with cookie sessions, an expiration is set. The expiration timestamp makes the JWT valid until the expiration passes.

Upvotes: 2

Related Questions