Quantcast
Channel: Active questions tagged https - Stack Overflow
Viewing all articles
Browse latest Browse all 1642

Why the JWT over https make the token expired randomly?

$
0
0

I have created a REACT application that calls some REST APIs to get data from a Node.js server.To enhance security, I am using JWT-based authentication.It is working properly in the development environment.In the production environment, I use an HTTPS-protected Apache server as a proxy server to forward requests to my application.

In this environment, I found that the JWT is not working steadily. Sometimes, the application prompts the "JWT expired" message on the server even though the user has logged in.

Here is my server-side code:

let sendResponse = async (res, action, param, jwt, usrObj, headers = {}) => {try {    //res.send(await action(param));    const sanitized = { ...usrObj };    delete sanitized.iat;    delete sanitized.exp;    res.setHeader('x-access-token', jwt.sign(sanitized));    let result = await action(param);    if (Object.keys(headers).length === 0) {        let returnObj = {            result        }        res.send(returnObj);    } else {        for (const [key, value] of Object.entries(headers)) {            res.setHeader(key, value);        }        res.send(result);    }} catch (error) {    console.log(error.message);    res.status(400).send(error.message);}

}

where "action" is a function that gets data from my database.The application has an Excel file generation feature, the sendResponse function should support file download.

Here is my JWT class:

import jwt from "jsonwebtoken";export default class JWT {    #accessTokenSecret;    #expirePeriod;    constructor(secret, expirePeriod) {        this.#accessTokenSecret = secret;        this.#expirePeriod = expirePeriod;    }    isValid = async token => {        try {            return jwt.verify(token, this.#accessTokenSecret);        } catch (error) {            throw new Error(`${error.message}`);        }    }    sign = (dataObj) => {        return jwt.sign(            dataObj,            this.#accessTokenSecret,            {                expiresIn: this.#expirePeriod,                algorithm: "HS256"            });    }}

If I open my application to the internet without the Apache server, it back to normal.

So, what's going on?


Viewing all articles
Browse latest Browse all 1642

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>