Allow to configure JWT expiration

[phlmn]

We are currently doing a penetration test on strapi. One finding was that the JWTs in the admin section don't get invalidated on logout and also have a very long validity period (30d 😱).

I would suggest to add a configuration option which allows to set the expiresIn option here:

strapi/packages/strapi-plugin-users-permissions/services/Jwt.js

Line 12 in 6309af2

const defaultJwtOptions = { expiresIn: '30d' };

I'm happy to file a PR if you like that idea. 🙂

Cheers

[lauriejim]

Hello @phlmn !
Thank you for this suggestion, this is a really simple thing to do.
Can you please submit a PR to add this feature.
I will appreciate your contribution.

You will have to remove this line - https://github.com/strapi/strapi/blob/master/packages/strapi-plugin-users-permissions/services/Jwt.js#L12

Add in the config folder create a jwt.json file - https://github.com/strapi/strapi/blob/master/packages/strapi-plugin-users-permissions/config/
Similar to the request one.

And is the first file I linked, do the same as here to load configurations - https://github.com/strapi/strapi/blob/master/packages/strapi-plugin-users-permissions/config/policies/rateLimit.js#L20

You will also have to add this option in the documentation.

[lauriejim]

#6315