JWT Token authentication, expired tokens still working, .net core Web Api

authentication token jwt .net-core

34,106

Solution 1

I believe this has to do with ClockSkew in JwtBearerOptions.

Change to TimeSpan.Zero as I fhink the default is set to 5 minutes (not 100% sure though).

I have posted some sample code below that is to be placed in Startup.cs => Configure.

        app.UseJwtBearerAuthentication(new JwtBearerOptions()
        {
            AuthenticationScheme = "Jwt",
            AutomaticAuthenticate = true,
            AutomaticChallenge = true,
            TokenValidationParameters = new TokenValidationParameters()
            {
                ValidAudience = Configuration["Tokens:Audience"],
                ValidIssuer = Configuration["Tokens:Issuer"],
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Tokens:Key"])),
                ValidateLifetime = true,
                ClockSkew = TimeSpan.Zero
            }
        });

Solution 2

If your expiry time is well over the default (5 mins) or over a set a time like I had and it still considers expired token as valid, and setting the ClockSkew to TimeSpan.Zero has no effect, make sure you have the property

ValidateLifetime

set to true as I had mine set to false causing the problem, which totally make sense, but it was an easy oversight.

services.AddAuthentication(option =>
    {
        option.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        option.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = Configuration["JwtToken:Issuer"],
            ValidAudience = Configuration["JwtToken:Issuer"],
            IssuerSigningKey = new SymmetricSecurityKey(
               Encoding.UTF8.GetBytes(Configuration["JwtToken:SecretKey"]))
        };
    });

Solution 3

There is an additional delay of 5 minutes in the library itself.

If you are setting 1 minute as indicated for expiration, the total will be 6 minutes. If you set 1 hour the total will be 1 hour and 5 minutes.

34,106

Jamadan

var DarthJam = new SithNerd { Description = "My powers come from the dark side, my hackery is not pretty", PowerLevel = 90, Accuracy = "+/- 50", SpecialPowers = "React, Node, AWS", NewestPowers = "Amplify", Quotes = new [] { "I may not do things the "proper" way, but it'll work damn it!", "Who needs unit testing anyway? My code just works.", "Agile is a myth, it's only a word that covers up for cowboys.", } }

Updated on July 09, 2022

Comments

Jamadan almost 2 years

I'm building a .net core web api.

Preface - I've implemented token authentication as per https://stormpath.com/blog/token-authentication-asp-net-core and https://dev.to/samueleresca/developing-token-authentication-using-aspnet-core. I've also read a few issues on github and here on SO.

This also came in handy https://goblincoding.com/2016/07/24/asp-net-core-policy-based-authorisation-using-json-web-tokens/.

After implementing it all I'm feeling like I'm missing something.

I've created a simple Angular application that sits in a web client. When I authenticate, client is sent a token. I'm storing that in session for now (still in dev so will address security concerns around where to store it later).

Not really sure this (JWT (JSON Web Token) automatic prolongation of expiration) is useful as I haven't implemented refresh tokens as far as I can see.

I noticed that when I call logout, and then log back in again, the client is sent a new token - as expected. However, if the token expiry time is passed (I set it to 1 minute for testing) and then the page is refreshed, the token seems to remain the same in my app. i.e. it's as if the token never expires?!

I would have expected the client to be returned a 401 Unauthorised error and I can then handle forcing the user to re-authenticate.

Is this not how this should work? Is there some auto-refresh token magic going on in the background that is default (I haven't set up any notion of refresh tokens in the tutorials explicitly)? Or am I missing something about the concept of token auth?

Also - if this is a perpetually refreshing token, should I be concerned about security if the token was ever compromised?

Thanks for your help
Michael K over 4 years

For me, I needed both ValidateLifetime AND ClockSkew using Core 2.2
jps almost 4 years

what do you mean with additional delay of 5 minutes in the library itself? Do you mean additional to the already mentioned ClockSkew?
FranzHuber23 almost 4 years

He means the already mentioned ClockSkew I would say.
FranzHuber23 almost 4 years

I can confirm that this works in NetCore3.1. Funny that this is not really documented in the docu: docs.microsoft.com/en-us/dotnet/api/…. The default is 5 minutes (Check docs.microsoft.com/en-us/dotnet/api/…).
jps almost 4 years

Maybe, but there's already a good and clear answer about the ClockSkew, so why do we need an additonal, quite unclear answer?
João Pedro Hudinik almost 4 years

Yes, I'm talking about ClockSkew, it was a way that I found to exemplify.
live2 about 3 years

docs.microsoft.com/en-us/dotnet/api/…
Michael Freidgeim over 2 years

See also stackoverflow.com/questions/47153080/clock-skew-and-tokens about clock-skew