How to set long expiry to JWT Token?

gomij

2y1kC#

private string GenerateJSONWebToken(pswd user)
{
    var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Jwt:Key"]));
    var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);
 
    var token = new JwtSecurityToken(_config["Jwt:Issuer"],
      _config["Jwt:Issuer"],
      null,
      expires: DateTime.Now.AddYears(100),
      signingCredentials: credentials);

    return new JwtSecurityTokenHandler().WriteToken(token);
}

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Ishika Tiwari2y ago

Accepted answer

If you want to set the expiry to a specific date in the future, you can replace

var expiryDate = new DateTime(2024, 12, 31);
var token = new JwtSecurityToken(_config["Jwt:Issuer"],
    _config["Jwt:Issuer"],
    null,
    expires: expiryDate,
    signingCredentials: credentials);

If you want to set the token to never expire, you can use the DateTime.MaxValue

var token = new JwtSecurityToken(_config["Jwt:Issuer"],
    _config["Jwt:Issuer"],
    null,
    expires: DateTime.MaxValue,
    signingCredentials: credentials);

Note:

I suggest you don't extend the expiry of JWT tokens. Instead, you can use the concept of refresh tokens.

Aravind Govindaraj2y ago
I agree with Abishek, typically your access token is supposed to be limited expiry time, if at all if you want to extend that session with token, apply refresh token concept.
Abhishek Yadav2y ago
The expiration date is there for security reasons. I would possibly rather look into how to extend it when users are active, or a refresh token perhaps.