82

I dont want my token to get expire and shold be valid forever.

var token = jwt.sign({email_id:'[email protected]'}, "Stack", {

                        expiresIn: '24h' // expires in 24 hours

                         });

In above code i have given for 24 hours.. I do not want my token to get expire. What shall be done for this?

8
  • 2
    That seems like a bad idea. But you can try to leave this parameter off (check the API documentation for your JWT library). If that does not work, set it to one million hours
    – Thilo
    Jul 20, 2017 at 6:46
  • 1
    You should add hours you want to set. Best practice will set to 8760 hours that is 1 year
    – Ved
    Jul 20, 2017 at 6:48
  • so setting hour is mandatory?
    – Jagadeesh
    Jul 20, 2017 at 6:55
  • if i give for 10 years by calculating the total number of hours will it work?
    – Jagadeesh
    Jul 20, 2017 at 6:57
  • 2
    Are you using this library npmjs.com/package/jsonwebtoken? Why you do not omit the expiresIn param? The exp attribute of JWT is optional. You do not need to fill it, and then the token will not expire
    – pedrofb
    Jul 20, 2017 at 8:06

7 Answers 7

89

The exp claim of a JWT is optional. If a token does not have it, it is considered that it does not expire

According to the documentation of https://www.npmjs.com/package/jsonwebtoken the expiresIn field does not have a default value either, so just omit it.

There are no default values for expiresIn, notBefore, audience, subject, issuer. These claims can also be provided in the payload directly with exp, nbf, aud, sub and iss respectively, but you can't include them in both places.

var token = jwt.sign({email_id:'[email protected]'}, "Stack", {});
0
61

To set expirey time in days: try this

 var token = jwt.sign({email_id:'[email protected]'}, "Stack", {

           expiresIn: '365d' // expires in 365 days

      });

"expiresIn" should be a number of seconds or string that repesents a timespan eg: "1d", "20h",

Docs: jsonwebtoken

3
  • 1
    any option for setting up in years?
    – Jagadeesh
    Jul 20, 2017 at 7:10
  • 1
    I think no. You can set it in days. 365d = 1 year
    – Ved
    Jul 20, 2017 at 7:11
  • 2
    if i give for 10 years by calculating the number of days as 3650d will it work?
    – Jagadeesh
    Jul 20, 2017 at 7:13
47

You can set expire time in number or string :

expressed in seconds or a string describing a time span zeit/ms.
Eg: 60, "2 days", "10h", "7d".

A numeric value is interpreted as a seconds count. If you use a string be sure you provide the time units (days, hours, etc),
otherwise milliseconds unit is used by default ("120" is equal to "120ms").

 var token = jwt.sign({email_id:'[email protected]'}, "Stack", {
        expiresIn: "10h" // it will be expired after 10 hours
        //expiresIn: "20d" // it will be expired after 20 days
        //expiresIn: 120 // it will be expired after 120ms
        //expiresIn: "120s" // it will be expired after 120s
 });
0
11

You can save your settings in a config file. expires in days use d after your desire days like after 90 days should be: 90d for hours use h for example 20h

you can use milliseconds also, for example, after 4102444800ms

config.env

JWT_SECRET = my-32-character-ultra-secure-and-ultra-long-secret
JWT_EXPIRES_IN = 90d

authController.js

const signToken = (id) => {
  return jwt.sign({ id: id }, process.env.JWT_SECRET, {
    expiresIn: process.env.JWT_EXPIRES_IN,
  });
};

const signIn = (user) =>{
    const token = signToken(user._id);
}
1
  • is expiresIn in jwt different from the maxAge in cookies? I'm sending the jwt as a cookie to the client but it seems like setting expiresIn doesn't affect the cookie Oct 13, 2020 at 3:36
8
  jwt.sign(contentToEncrypt, SECRET_KEY, { expiresIn: '365d' });
1

If you dont set expiresIn options it wont expire. If you want to set time;

('2 days')  // 172800000
('1d')   // 86400000
('10h')  // 36000000
('2.5 hrs') // 9000000
('2h')      // 7200000
('1m')      // 60000
('5s')      // 5000
('1y')      // 31557600000
('100')     // 100
('-3 days') // -259200000
('-1h')     // -3600000
('-200')    // -200
-1
const expirationTime = Math.floor(Date.now() / 1000) + 15 * 60; // 15 minutes

const token = jwt.sign(
  { userId: user._id },
  process.env.SECRET_KEY,
  { expiresIn: expirationTime },
);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.