I am testing a mobile web application. The application uses JWT token for login (authentication). When I log in application sends the following request:

POST /api/authenticate HTTP/1.1
Content-Type: application/json

{"password":"test", "username":"app_test"} 

The response contains JWT token that is valid for one month (exp value in payload).

In my opinion, it is definitely too long, am I right? Are there any recommendations regarding this issue?

My second question regards payload data, which looks like this:

  "sub": "app_test",
  "auth": "ADMIN",
  "exp": 1557237010

app_test is the user login (login to the mobile application and also corresponding web application). Is it safe to send user login in every request, when it is also login to web application?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.