JWT Token authentication, expired tokens still working, .net core Web Api

Question

I'm building a .net core web api.

Preface - I've implemented token authentication as per https://stormpath.com/blog/token-authentication-asp-net-core and https://dev.to/samueleresca/developing-token-authentication-using-aspnet-core. I've also read a few issues on github and here on SO.

This also came in handy https://goblincoding.com/2016/07/24/asp-net-core-policy-based-authorisation-using-json-web-tokens/.

After implementing it all I'm feeling like I'm missing something.

I've created a simple Angular application that sits in a web client. When I authenticate, client is sent a token. I'm storing that in session for now (still in dev so will address security concerns around where to store it later).

Not really sure this (JWT (JSON Web Token) automatic prolongation of expiration) is useful as I haven't implemented refresh tokens as far as I can see.

I noticed that when I call logout, and then log back in again, the client is sent a new token - as expected. However, if the token expiry time is passed (I set it to 1 minute for testing) and then the page is refreshed, the token seems to remain the same in my app. i.e. it's as if the token never expires?!

I would have expected the client to be returned a 401 Unauthorised error and I can then handle forcing the user to re-authenticate.

Is this not how this should work? Is there some auto-refresh token magic going on in the background that is default (I haven't set up any notion of refresh tokens in the tutorials explicitly)? Or am I missing something about the concept of token auth?

Also - if this is a perpetually refreshing token, should I be concerned about security if the token was ever compromised?

Thanks for your help

DJDJ · Accepted Answer · 2022-09-30 19:12:17Z

157

I believe this has to do with ClockSkew in JwtBearerOptions.

Change to TimeSpan.Zero as I think the default is set to 5 minutes (not 100% sure though).

I have posted some sample code below that is to be placed in Startup.cs => Configure.

        app.UseJwtBearerAuthentication(new JwtBearerOptions()
        {
            AuthenticationScheme = "Jwt",
            AutomaticAuthenticate = true,
            AutomaticChallenge = true,
            TokenValidationParameters = new TokenValidationParameters()
            {
                ValidAudience = Configuration["Tokens:Audience"],
                ValidIssuer = Configuration["Tokens:Issuer"],
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Tokens:Key"])),
                ValidateLifetime = true,
                ClockSkew = TimeSpan.Zero
            }
        });

edited Sep 30, 2022 at 19:12

answered Apr 18, 2017 at 7:44

DJDJ

1,8762 gold badges13 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Michael Freidgeim Over a year ago

See also stackoverflow.com/questions/47153080/clock-skew-and-tokens about clock-skew

Gideon Kimutai Over a year ago

Agreed the default ClockSkew is set to 5 minutes. If you run in debug, and then inspect, you will be able to see it.

Pang · Accepted Answer · 2025-10-09 06:12:44Z

29

If your expiry time is well over the default (5 mins) or over a set a time like I had and it still considers expired token as valid, and setting the ClockSkew to TimeSpan.Zero has no effect, make sure you have the property

ValidateLifetime

set to true as I had mine set to false causing the problem, which totally make sense, but it was an easy oversight.

services.AddAuthentication(option =>
    {
        option.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        option.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = Configuration["JwtToken:Issuer"],
            ValidAudience = Configuration["JwtToken:Issuer"],
            IssuerSigningKey = new SymmetricSecurityKey(
               Encoding.UTF8.GetBytes(Configuration["JwtToken:SecretKey"]))
        };
    });

edited Oct 9 at 6:12

Pang

10.2k146 gold badges87 silver badges126 bronze badges

answered Dec 30, 2019 at 2:34

Thierry

6,49614 gold badges78 silver badges136 bronze badges

2 Comments

Michael K Over a year ago

For me, I needed both ValidateLifetime AND ClockSkew using Core 2.2

FranzHuber23 Over a year ago

I can confirm that this works in NetCore3.1. Funny that this is not really documented in the docu: learn.microsoft.com/en-us/dotnet/api/…. The default is 5 minutes (Check learn.microsoft.com/en-us/dotnet/api/…).

João Pedro Hudinik · Accepted Answer · 2020-07-15 06:07:57Z

21

There is an additional delay of 5 minutes in the library itself.

If you are setting 1 minute as indicated for expiration, the total will be 6 minutes. If you set 1 hour the total will be 1 hour and 5 minutes.

answered Jul 15, 2020 at 6:07

João Pedro Hudinik

2112 silver badges2 bronze badges

5 Comments

jps Over a year ago

what do you mean with additional delay of 5 minutes in the library itself? Do you mean additional to the already mentioned ClockSkew?

FranzHuber23 Over a year ago

He means the already mentioned ClockSkew I would say.

jps Over a year ago

Maybe, but there's already a good and clear answer about the ClockSkew, so why do we need an additonal, quite unclear answer?

João Pedro Hudinik Over a year ago

Yes, I'm talking about ClockSkew, it was a way that I found to exemplify.

live2 Over a year ago

learn.microsoft.com/en-us/dotnet/api/…

Sudam Yasodya · Accepted Answer · 2021-04-04 09:15:55Z

In my case, I added a new SecurityTokenDescriptor which contains properties that take the current date and time and expires based on our requirements. Below is a sample login controller with a post request, which in turn returns the user details with a token.

        public async Task<ActionResult<UserWithToken>> Login([FromBody] User user)
        {
             user = await _context.Users
                                    .Include(u => u.Reservations)
                                .Where(u => u.Email == user.Email
                                   && u.Password == user.Password)
                                .FirstOrDefaultAsync();

            if (user == null)
            {
                return NotFound();
            }

            UserWithToken userWithToken = new UserWithToken(user);

            if (userWithToken == null)
            {
                return NotFound();
            }

            var tokenHandler = new JwtSecurityTokenHandler();
            var key = Encoding.ASCII.GetBytes(_jwtsettings.SecretKey);
            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(new Claim[]
                {
                    new Claim(ClaimTypes.Name, user.Email)
                }),
                Expires = DateTime.UtcNow.AddMinutes(10),
                SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key),
                SecurityAlgorithms.HmacSha256Signature)
            };
            var token = tokenHandler.CreateToken(tokenDescriptor);
            userWithToken.Token = tokenHandler.WriteToken(token);

            return userWithToken;
        }

Here token will expires in 10 minutes.

Jivopis · Accepted Answer · 2024-05-20 16:14:24Z

1

JWT Often Add additional 5 minutes to expiry.

If you generate a token with expiry of 5 minutes from now, it will add additional 5 minutes to it.

exp: 5+5 = 10

exp: 60+5 = 65

Example:

var token = new JwtSecurityToken(
    issuer: any issuer,
    claims: claims,
    expires: DateTime.UtcNow.AddMinutes(5),
    signingCredentials: credentials
);

Tthis will create for 10 minutes. I hope it will help you and dont forget to set ValidateLifetime = true, in program.cs (if using .NET 6 or later).

edited May 20, 2024 at 16:14

Jivopis

1,5361 gold badge14 silver badges33 bronze badges

answered May 15, 2024 at 6:53

Sheheryar Ali

112 bronze badges

2 Comments

Jivopis Over a year ago

It's configurable parameter of the token validation. It's named ClockSkew, accepts TimeSpan. Link to the resource: learn.microsoft.com/en-us/dotnet/api/…

Umar Aftab Over a year ago

Try to add details to your answer and how it helps solve the problem.

Collectives™ on Stack Overflow

JWT Token authentication, expired tokens still working, .net core Web Api

5 Answers 5

2 Comments

2 Comments

5 Comments

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

2 Comments

5 Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related