Check If Token Expired Using This Jwt Library

const JWT = `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjEyMzQ1Njc4OTAsIm5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMn0.1c_yQjnMZfKUb4UTDE_WvbC71f8xxtyMsdqKKkI1hF8`;

const jwtPayload = JSON.parse(window.atob(JWT.split('.')[1]))
console.log(jwtPayload.exp);

How to check if a JWT Token has expired without throw exceptions?

If you use a different JWT library, you can do it easily enough. The auth0 JWT library has methods to parse and, optionally, verify the token:

import com.auth0.jwt.JWT;
import com.auth0.jwt.exceptions.JWTDecodeException;
import com.auth0.jwt.interfaces.DecodedJWT;


DecodedJWT jwt = JWT.decode(token);
if( jwt.getExpiresAt().before(new Date())) {
    System.out.println("token is expired");
}

jwt.verify() returns jwt expired when the expiration is 24h

So since the question is, how does jwt check the expiration date, it depends on basically on some properties that may be implemented according to the JWT RFC

One would be exp. In case a token expires before the current datetime, then the JWT cannot be processed

The "exp" (expiration time) claim identifies the expiration time on
or after which the JWT MUST NOT be accepted for processing. The
processing of the "exp" claim requires that the current date/time
MUST be before the expiration date/time listed in the "exp" claim.

Implementers MAY provide for some small leeway, usually no more than
a few minutes, to account for clock skew. Its value MUST be a number
containing a NumericDate value. Use of this claim is OPTIONAL.

Another one to note would be the iat, which stands for issued at

The "iat" (issued at) claim identifies the time at which the JWT was
issued. This claim can be used to determine the age of the JWT. Its
value MUST be a number containing a NumericDate value. Use of this
claim is OPTIONAL.

A final one that could be used for time verfication, as far as I am aware of would be, nbf, standing for not before

The "nbf" (not before) claim identifies the time before which the JWT
MUST NOT be accepted for processing. The processing of the "nbf"
claim requires that the current date/time MUST be after or equal to
the not-before date/time listed in the "nbf" claim. Implementers MAY
provide for some small leeway, usually no more than a few minutes, to
account for clock skew. Its value MUST be a number containing a
NumericDate value. Use of this claim is OPTIONAL.

Now, for the code at hand, I don't see anything which is of, having following setup, this works perfectly fine for me

const jwt = require('jsonwebtoken');

const token = jwt.sign( {
  hello: 'world'   
}, 'myverysecretkey', {
    expiresIn: '24h'
});

try {
    const verify = jwt.verify( token, 'myverysecretkey' );
    console.log( verify );
} catch (err) {
    console.error( err );
}

which would output

Object {hello: "world", iat: 1557840459, exp: 1557926859}

This can be validated on the codesandbox link

Checking token expiration and log user out

so it turns out, i've been doing the check at the wrong place.

found out with some help that i could check under another function and here are the codes:

const ProtectedRoute = ({
  component: Component,
  roles = undefined,
  ...rest
}) => {
  function isAuthActive() {
    const user = JSON.parse(localStorage.getItem('User'));
    const expiryTime = new Date(user?.expiration * 1000).toLocaleString(
      'en-sg'
    );
    const currentTime = new Date().toLocaleString('en-sg');
    if (expiryTime < currentTime) {
      setCurrentUser();
      localStorage.clear();
      return <Redirect to="/login" />;
    }
    return true;
  }
};

basically just checking current time against the expiry time given by the token. the rest are set in the backend server.

jwt.verify not throwing error for expired tokens

In your code you added expiresIn as part of the payload. But there expiresIn has no meaning and you need to use the standard expclaim for expiration:

jwt.sign({
  id: 'an id',
  exp: Math.floor(Date.now() / 1000) + (60 * 2),
  iat: Math.floor(Date.now())
}, 'secret')

in this example it's 2 minutes.
You can also calculate:
(60 * minutes), (3600 * hours) or (86400 * days) for minutes, hours or days.

expiresIn can be used as an option to the sign method as shown in Shivam Soods answer. I think that's the reason for your confusion.

---

Related Topics