Security - JWT and Oauth2 (refresh token)

Question

I have a angular client app and a .net web api server. I'm trying to understand how to implement security in the best way using tokens. I thought about few options, and I don't know which one is the best, or if there is a better way.

JWT with expiration

1.User login with credentials -> Server returns a JWT with expiration (for example 60 minutes from login time). Each valid request to the server within this 60 minutes the server returns a new JWT token with a new expiration of 60 minutes. If user didn't send server request for 60 minutes he must login again. This solution is very similiar to sessions.

Oauth2 - I don't think I understand this protocol correctly, so I apologize if what I'm saying is not correct.

2.User login with credentials -> user gets a refresh_token and access_token. For every request, the client attaches the access_token. If server returns 401 (unauthorized) the client uses the refresh_token to create a new access_token and re-send the failed request with the new token.

The problem in this flow, for me, is that I don't know if I got unauthorized because the token was invalid or the user tried to access unauthorized resources.

This led me to a third solution.

3.User login with credentials -> user gets a refresh_token, access_token and access_token_expiration. When the user wants to create a request to the server, he checks if access_token has expired. If expired, the client will request a new access_token with new expiration and only then perfroms the request.

And 2 more little question about auth2:

1.Why do I have a refresh_token and access_token? Both of them are stored in client local storage. Why not to always use the refresh_token? For the server it makes sense to have a refresh_token and access_token since the refresh_token is secured.

2.Does the refresh token have an expiration date? If it does, how can I create a new refresh token? If it doesn't, isn't it a little unsave to give the ability to stay connected forever?

Thank you very much for your help

jps jps · Accepted Answer · 2017-07-20T09:56:50

Option 3, login with credentials and getting an access token, refresh token and expiration time is the usual way. eg.:

{   
  "access_token": "eyJ0eXA....CqVJcc",  
  "token_type": "bearer",
  "expires_in": 3599,   
  "refresh_token": "AQAAAN...H2JXjIUAQ"
}

the expiration time of the JWT access token can also be found in the token itself in the payload field exp, in form of a UNIX timestamp:

{
  ...
  "exp": 1500547257,
  "nbf": 1500543657
   ...
}

With that information you can implement your own mechanism to check if your access token is still valid and refresh it when necessary.

The refresh token usually also expires. When the refresh token is expired, you need to start again with the credentials.

Additionally you can read this for further information about the topic: https://auth0.com/learn/refresh-tokens/

And here is a tutorial that talks about handling of refresh tokens in Angular: http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/

Security - JWT and Oauth2 (refresh token)

1 Answers