Log out user after inactivity with JWT Access and Refresh tokens

Question

I implement autentication mechanism in web application with Angular 2.

I going to use JSON Web Token. Two types of token, Access token (short-lived) and Refresh token (long-lived) which are described here: https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/

I want to obtain result which is common when session/cookies are used. After a period time of user inactivity, the user is logged out. Which basiclly means that the browser displays the login page and in case of using JWT, the tokens are removed from browser localStorage or storage cookies.

I do not see the way how to do this, relaing only on Access and Refresh tokens.

When Access token is expired (eg. each 10 minutes), the new one is requested using Refresh token (which expires each 8 hours). But what when the user is inactive for eg. 1 hour? Refresh token is still valid so next user interaction will cause obtain new Access token and the user sill can use th app.

Maybe there are some Angular2 or JavaScript mechanisms which in case of user inactivity, perform some action or redirect to login page?

Answer 1

Just cache timestamp of last user activity (for users you want to run periodic check) and revoke refresh token when it cross your threshold + remove user from that cache. If you really really need that behaviour. If you accept server side solution.

If you mean Angular client side solution, just forget the token pair after given inactivity period.

Answer 2

If you want to use token as flag to terminate session just don't refresh it, just set a short time of life and when server replies with 401 sign out the user. For this approach you have to generate a new token after each user interaction.

Answer 3

You Can Implement some client side rule i.e Whenever access token going to expire redirect them to login page or you can lock user's screen to provide enter credential again.Please look features of angular2 JWT