Demystifying JWT Token Expiration: Theory and Best Practices in Angular

Introduction:
In the world of web development, security is paramount. JSON Web Tokens (JWT) have become a popular method for securely transmitting information between parties. One crucial aspect of JWTs is their expiration, which ensures that tokens don’t remain valid indefinitely, mitigating the risk of unauthorized access. In this article, we’ll delve into the theory behind JWT token expiration and explore best practices for implementing expiration checks effectively.

Understanding JWT Token Expiration:
JWTs consist of three parts: a header, a payload, and a signature. The payload contains the claims, which are statements about an entity (typically the user) and additional data. One of these claims can be the token’s expiration time, denoted by the “exp” claim.

The expiration time is a Unix timestamp that specifies when the token should no longer be considered valid. When a JWT is issued, the expiration time is set based on the desired duration of validity. Once this time is reached, the token is considered expired and should no longer be accepted by the server.

Implementing Expiration Checks:

Client-Side Expiration Check:
While JWTs are often used for authentication, it’s essential to perform expiration checks on both the client and server sides. Client-side checks involve verifying the token’s expiration time before sending it to the server. This step helps reduce unnecessary server requests with expired tokens, improving overall efficiency.

Server-Side Expiration Check:
Server-side expiration checks are crucial for security. Even if the client performs an expiration check, malicious users could tamper with the token to extend its validity. Therefore, servers must independently verify the token’s expiration time upon receiving it. This validation ensures that only valid tokens are accepted for further processing.

Code

  import { Injectable } from '@angular/core';
  import { JwtHelperService } from '@auth0/angular-jwt';

  @Injectable({
  providedIn: 'root'
  })
  export class TokenDecodeService {
    public helper = new JwtHelperService();

    constructor() { }

    public getDecodedAccessToken(token: string): boolean {
      const decodedToken = this.helper.decodeToken(token);

      const currentDate = new Date();
      //converting current date to Unix time stamp
      const currentUnixTimestamp = Math.floor(currentDate.getTime() / 1000);

      // TOKEN EXPIRED
      if(decodedToken.exp < currentUnixTimestamp){
        return true;
      }


      // TOKEN NOT EXPIRED
      return false;
    }
  }
  

Conclusion:
JWT token expiration is a critical aspect of web security, ensuring that tokens remain valid only for a specified duration. By understanding the theory behind JWT expiration and following best practices for implementation, developers can enhance the security of their applications while providing a seamless user experience. Effective expiration checks, both on the client and server sides, are essential for mitigating the risk of unauthorized access and maintaining data integrity.