Django Rest JWT 身份验证 - 刷新令牌

Question

I have a problem with my Django REST application and JWT authentication module ( https://jpadilla.github.io/django-rest-framework-jwt ) in phase of refresh token.

Default logic of refresh token says that non-expired tokens can be "refreshed" to obtain a brand new token with renewed expiration time . Expiration time is setting to BE.

JWT framework provides an API for refresh token and you should use that to obtain new token and so expiration time reset every "user action" on web app. This means that every call to BE from my Angular6 SPA must reset expiration time of a token.

I thought three ways to go:

1) Every call to BE from FE must call back api to refresh token. This means that number of calls are duplicate always. Not elegant!

2) Call api to refresh token according to an alghoritm (in FE) to avoid duplicated calls. Which alghoritm?

3) Reset expiration time of token to back end every call from FE, and use the same token from FE. I can not to do this!

Any suggestions?

Thanks

Answer 1

You don't need to refresh you token with every api call. Only a few minutes before expiration. Most tokens contain the expiration time. So you need to refresh it every time it almost expires. Something like this: token.expiration - curenttime =< 5 minutes .

I believe there are some libraries that can do that for you. Maybe Auth0