I am currently building a RESTful API that will be used for a web and mobile app. Authentication to the API will be done using JSON Web Tokens.
When using JWT, we can use the
exp claim to expire the token after a specific time. This, combined with the
jti claim is useful to prevent replay attacks, and something that will be built in to our app. However, for user convenience, we do not want to keep asking them to log in with every request or after short intervals of say, 30 minutes.
So, I'm thinking of the following situation:
- User logs in using their email address and password
- Server sends back a JWT with an expiry in 1 hour
- The client makes another request to the API, passing the JWT in the header
- If the JWT is valid, the API sends back the requested data, and another JWT, which again expires in 1 hour
If the client does not make any further requests within the allocated 1 hour expiration time, a subsequent request would ask them to log in again.
My question: is this the best solution trade off between usability and preventing replay attacks?