-1

I'm making a mobile application, and I use JSON Web Token Authentication (JWT Auth), but I have three questions about:

  1. Should I use refresh-tokens or non-expiring access tokens?
  2. In case I use refresh-tokens, when the token expires, should I sign out the user (and force the user to login again) or create a new one and send it back to the app so it can be used for future requests?
  3. How should I save the token on the mobile (database, preferences,etc.)?

Any help and resource about this (books,documents,blog,etc.) would be appreciated, thanks in advance!

1 Answer 1

0

1.In case you have a "remember me" option in your page you should use the non-expiring token. Otherwise ,in my opinion you should use the refresh one.

2.Token expiration should be handled by asking the user to login again. The tricky part is when the token expires while the user is in the middle of something .In that case you should try remembering what action he was trying to do before the token expired and allow him to continue once he has logged in again.

3.You could use local storage for storing tokens. You can set it to a variable in the storage once authentication is complete and there after keep appending that storage value to the http header of every subsequent protected web service request.

2
  • Hi Rahul, thanks for your answer, my mother tongue is spanish, my english is good enough to understand what you wrote, but there are other people which won't understand what you wrote, so consider write it well, please :D Feb 1, 2015 at 5:17
  • There tried to make it better ;).I'm typing from my cellphone so auto correct never really works that well.I should have read and edited my answer before posting though. My bad :) Feb 1, 2015 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.