I’m making a mobile application, and I use JSON Web Token Authentication (JWT Auth), but I have three questions about:
- Should I use refresh-tokens or non-expiring access tokens?
- In case I use refresh-tokens, when the token expires, should I sign out the user (and force the user to login again) or create a new one and send it back to the app so it can be used for future requests?
- How should I save the token on the mobile (database, preferences,etc.)?
Any help and resource about this (books,documents,blog,etc.) would be appreciated, thanks in advance!
1.In case you have a “remember me” option in your page you should use the non-expiring token. Otherwise ,in my opinion you should use the refresh one.
2.Token expiration should be handled by asking the user to login again. The tricky part is when the token expires while the user is in the middle of something .In that case you should try remembering what action he was trying to do before the token expired and allow him to continue once he has logged in again.
3.You could use local storage for storing tokens. You can set it to a variable in the storage once authentication is complete and there after keep appending that storage value to the http header of every subsequent protected web service request.
2