Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generate tokens without expiry #20

Closed
sksk571 opened this issue Nov 2, 2022 · 3 comments
Closed

Generate tokens without expiry #20

sksk571 opened this issue Nov 2, 2022 · 3 comments
Labels

Comments

@sksk571
Copy link

sksk571 commented Nov 2, 2022

Expiry isa mandatory parameter of the Encode method and it causes "exp" claim to be automatically inserted into a token. In our case we want to generate tokens without the expiry and also want to keep token as short as possible. Is it possible to add a method overload that generates tokens without expiry?

@neuecc
Copy link
Member

neuecc commented Nov 4, 2022

We feel that no expiry is a risky option, so we will not allow it to be easily added (e.g., overloaded).

@seanm-fathomhq
Copy link

And yet according to spec, the "exp" field is not required:

The "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. The processing of the "exp" claim requires that the current date/time MUST be before the expiration date/time listed in the "exp" claim. Implementers MAY provide for some small leeway, usually no more than a few minutes, to account for clock skew. Its value MUST be a number containing a NumericDate value. Use of this claim is OPTIONAL.
https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4

@github-actions
Copy link

This issue is stale because it has been open 180 days with no activity. Remove stale label or comment or this will be closed in 30 days.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants