'JWT session extends after the first 20 minutes but timeout after 1 hour
I have a JWT session that asks user to extend the session every 20 minutes if the user is not doing anything on the site. BUT the session expires after 1 hour regardless whether the user is actively working on the site or not. Is there any way to prevent that? I have codes below that implement JWT, but due to the amount of codes I can't able to include all the codebase, but thought this may be enough to start.
AuthorizationHelper:
def authorize_request_and_set_current_user
request.headers["X-CSRF-Token"] = request.cookies["csrf_token"]
set_current_user
end
# This sets the user session by senting the JWT cookie to the user's browser
def set_user(user)
payload = {
user_id: user.id
}
session = JWTSessions::Session.new(payload: payload, refresh_by_access_allowed: true)
tokens = session.login
response.set_cookie(
cookies.permanent[JWTSessions.access_cookie] = secure_cookie_for(value: tokens[:access]),
cookies.permanent['csrf_token'] = secure_cookie_for(value: tokens[:csrf])
)
@current_user = user
user.record_session_id(nil)
user.after_login
end
exception_methods: This method renders a modal that jumps in the middle of page and ask user to login after 1 hour while user is using the website:
def not_authorized
flash[:error] = 'Please login in order to continue.'
redirect_to login_path
end
I can provide more code snippets if requested, but can something be done on JWT implementation to refresh the session while user is actively working on the site and not being kicked out after one hour?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
Solution | Source |
---|