Openiddict-core: JWT Access and Refresh Token Expiration

[geocine]

I currently have the following expiration life times set.

.SetAccessTokenLifetime(TimeSpan.FromMinutes(1))
.SetRefreshTokenLifetime(TimeSpan.FromMinutes(5))

Access Token Not Expiring

The access_token returned is ok which is a JWT. The decoded JWT has a valid exp claim. It should expire in a minute. I also get expires_in: 60 from my token endpoint. However after a minute it just doesn't expire. I have even checked the timestamp on the exp claim and the current UTC timestamp is already way beyond the exp claim.

Shouldn't the OpenIddict Authorization Middleware decode that JWT access_token and see that the token has already expired and return a 401 Unauthorized?

At some point it expires but not in 1 minute which I have set. I don't know how it decides if the token is already expired.

I am putting this attribute to my endpoints that I wanted secured. Is there a special one to be used for JWT?

[Authorize(ActiveAuthenticationSchemes = OAuthValidationDefaults.AuthenticationScheme)]

Refresh Token Expiration

How does the refresh token expire? It is not a JWT and there is no table to track these tokens . The only thing I understand about the OpenIddictToken table is it whitelists refresh tokens that can be used. I however prefer a blacklist. Can you give me some implementation details regarding the refresh token?

[kevinchalet]

Access Token Not Expiring

http://stackoverflow.com/questions/40142548/why-is-my-jwt-bearer-authentication-recognizing-tokens-as-expired-5-minutes-afte

Refresh Token Expiration

I however prefer a blacklist.

The current approach is based on a white list: refresh tokens that can't be found in the database are considered as invalid.

[geocine]

Thanks the Clock Skew concept is interesting.

I hope you don't mind me asking about the implementation of refresh token expiration checking. So I have a configuration to set the lifetime of the refresh token:

SetRefreshTokenLifetime(TimeSpan.FromMinutes(5))

How does it check if the refresh token is already expired? I am just curious how it does it. For the access token I know that it uses the exp claim because it is a JWT. But for the refresh token I have no idea how it is done?

[kevinchalet]

For the access token I know that it uses the exp claim because it is a JWT. But for the refresh token I have no idea how it is done?

The expiration date is stored as an authentication property inside the refresh token (which is encrypted using an authenticated encryption algorithm).

You can find the corresponding code in the aspnet/Security repo, which owns the ticket serializer used by OpenIddict for access tokens (when using the default format), authorization codes and refresh tokens: https://github.com/aspnet/Security/tree/dev/src/Microsoft.AspNetCore.Authentication/DataHandler

The "expiration" check is directly made by ASOS, the underlying OIDC framework used by OpenIddict: https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/blob/dev/src/AspNet.Security.OpenIdConnect.Server/OpenIdConnectServerHandler.Exchange.cs#L257

The corresponding test can be found here: https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/blob/dev/test/AspNet.Security.OpenIdConnect.Server.Tests/OpenIdConnectServerHandlerTests.Exchange.cs#L489-L524

[geocine]

@PinpointTownes as always thank you for the very valuable information. I hope this is not too much this will be my last question.

How do you determine which refresh token is which when storing the OpenIddictToken only has the id and the type. Do you include that id inside that refresh_token using the encryption algorithm you mentioned above?

[kevinchalet]

Do you include that id inside that refresh_token using the encryption algorithm you mentioned above?

Yep: https://github.com/openiddict/openiddict-core/blob/dev/src/OpenIddict.Core/Infrastructure/OpenIddictProvider.Serialization.cs#L34-L42