Nodejs jwt 令牌永不过期

Question

I create jwt token using jsonwebtoken. I set the token to expire after 5min to check but the token never expires, I always get the iat and exp at the same time like the log below:

{ 
   sub: '10001', 
   iat: 1627452909247, 
   exp: 1627452909547 
}
Issue at time: 7/28/2021, 1:15:09 PM | 1627452909247
Expire at time: 7/28/2021, 1:15:09 PM | 1627452909547

And below is my code for the issue and verify token:

const crypto = require('crypto');
const path = require('path');
const fs = require('fs');
const jwt = require('jsonwebtoken');

// Public Key
const pathToPublicKey = path.join( __dirname , ".." ,"/id_rsa_pub.pem");
const publicKey = fs.readFileSync(pathToPublicKey , "utf8");

// Private Key
const pathToPrivateKey = path.join( __dirname , ".." ,"/id_rsa_priv.pem");
const privateKey = fs.readFileSync(pathToPrivateKey , "utf8");

//const expiresIn = '5';
const expiresIn = '5m';
//const expiresIn = '1h';
//const expiresIn = '1d';

const issueJWT = (user) => {

  const user_id = user.user_id;

  const payload = {
    sub: user_id,
    iat: Date.now()
  };

  const jwtOptions = {
    expiresIn: expiresIn,
    algorithm: 'RS256'
  };

  const signedToken = jwt.sign(payload, privateKey, jwtOptions);

  return{
    token: "Bearer " + signedToken,
    expires: expiresIn,
  };

};

const authMiddleware = (req, res, next) => {
  const tokenParts = req.headers.authorization.split(" ");
  
  const jwtOptions = {
    expiresIn: expiresIn,
    algorithms: ['RS256']
  };

  if(tokenParts[0] === "Bearer" && tokenParts[1].match(/\S+\.\S+\.\S+/) !== null)
  {
    try {
      const verification =jwt.verify(tokenParts[1], publicKey, jwtOptions);
      req.jwt = verification ;
      next();
    } catch (error) {
      res.status(401).json({succsess: false , message: 'User Not Authenticated'});
    }
  }
}

module.exports = { issueJWT, authMiddleware};

I tried many ways but still not working.

Answer 1

The timestamps are wrong. Inspect your token in https://jwt.io and point with the mouse on the timestamp to see how these values are interpreted.

The timestamps in JWT are UNIX timestamps counted in seconds from 01.01.1970 00:00 UTC, not milliseconds (see my answer for more details).

The way the expiration time exp was set

const expiresIn = '5m';
const jwtOptions = {
    expiresIn: expiresIn,
    algorithms: ['RS256']
  };
const signedToken = jwt.sign(payload, privateKey, jwtOptions);

is correct and if you delete the line iat: Date.now() you would get a correct token, even with a iat , because that value is automatically included.

{
  "iat": 1627506023,
  "exp": 1627506323
}

But if the line iat: Date.now() is included, it not only produces a wrong iat but the exp is calculated as iat + 300 (300seconds or 5 minutes) and will also be wrong.

{
  "iat": 1627506191289,
  "exp": 1627506191589
}

The solution is to simply delete the line iat: Date.now() from your code. If you really need a timestamp in correct format which you want to calculate based on Date.now() you have to divide the value by 1000 and cut of the decimals, eg.:

nbf: Math.floor(Date.now()/1000)