Refreshing JWTs with Refresh Tokens | ASP.NET Core 5 REST API Tutorial 13

Hello everybody I'm Nick and today I will show you how you can implement JWT token refreshing using Refresh tokens in ASP.NET Core.

Don't forget to comment, like and subscribe :)

Social media:

#tutorial #rest #api

[TimCoulter]

Your presentation style is excellent. It must be very difficult to code accurately and explain your design strategy so clearly at the same time. Great result!

[tyomidi]

Hi Nick. Great video series! I found an issue with this, in that it only appears to work as in tests, the refresh tokens are being issued within the first 5 in mins of access token expiry. This is because the clockskew is set to 5 mins by default and if set to 0, they will be invalid each time. To solve this, I changed getprincipal to not validate the lifetime on the (expired) access token if the request was to refresh.

[divyangutube]

Thanks for the excellent work Nick. I have no idea of how much time it would have taken for me to build a proper REST API if I hadn't come across your videos.

[karlwhitehead]

Excellent tutorial series and very appreciated. Have you considered adding Roles to your API?

[HoleyMoleyAlex]

Great vid, well explained for a complicated topic. One minor question/quibble. At 14:30 instead of var expiryDateTimeUtc = new DateTime(1970, 1, 1, ... could you not instead do var expiryDateTimeUtc = ?

[msrahman]

Hi @nickchapsas, great video, thanks. Just have a question @22:19 you are saving RefreshToken on line 201 but haven't assigned the any value in RefreshToken.Token which is KEY field. How do we expect this to be populated?

Great series! Thanks, Nick! Keep up the good work.

[KavkkAZEcc]

Thank you for tutorial . I have an error on registration process after implementing these changes .
The problem is in here :

var refreshtoken = new RefreshToken
{
JwtId = token.Id,
UserId = user.Id,
CreationDate = DateTime.UtcNow,
Invalidated = false,

ExpiryDate = DateTime.UtcNow.AddMonths(6)
};

await // error
Because refreshtoken . Token can not be null . Thant is why it does't work

[grmOmi]

Excellent but kindly put this project somewhere so that we could explore it anytime otherwise if we miss something we would have to go through the videos again and again.

[meghamanoj]

Hey Nick! I am new to this concept and your series has helped me well! Thanks ya! But from where does the Refreshtoken class -> Token get its value from? For me, it is coming as null!

[Dude-izdw]

Nick, is my understanding correct?
If someone steals my refresh&access tokens from the localstorage of my broswer he/she can easily refresh it and thus access my data until I logout by deleting all refresh token which belong to my as a user?

[gagikohanyan]

Why do you set the expiry date 6 months for a refresh token if anyway you create a new one every 45 seconds ?

[EdvardasAlaburda]

Nick I was following your guide but instead of using entity framework I used my own database, based on repository pattern. I do not understand how you retrieve refresh token from entity framework with => x.Token == refreshToken); Your RefreshToken doesn't have such field...

[zhh]

There is a bug in the code. You need to set to zero if you want the lifespan of the token to be exact to what you set.

TokenValidationParameters tokenValidationParameters = new()
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(jwtOptions.Secret)),
ValidateIssuer = false,
ValidateAudience = false,
RequireExpirationTime = false,
ValidateLifetime = true,
ClockSkew = TimeSpan.Zero
};

in the GetClaimsPrincipalFromToken method, you don't want to use the TokenValidationParameters with ValidateLifetime equal to true. because if ValidateLifetime equals true then method will throw an error for expired tokens. So want to create a different TokenValidationParameters.

var tokenValidationParameters =
= false;
var principle = tokenHandler.ValidateToken(token, tokenValidationParameters, out var validatedToken);


please correct me if I'm wrong. I'm a learner too

[richardalbury]

Thanks for a very helpful series, Nick. Minor quibble, though: at 12:20, shouldn't the variable be called something like *claimsPrincipal* instead of *validatedToken* ? After all, you're calling *Get **_Principal_** FromToken()* ...

[Kulith]

It doesn't makes sense to use the same TokenValidationParameters from the Startup. I had to set ValidateLifetime = false in order to successfully validate an expired token and get the Principal. That makes sense, since an expired token should not validate. I don't understand how it would work for you.

[hicklc]

Thank you for a great tutorial on refresh tokens

[trungvang]

will we have to clean up the refreshTokens as it will grow big quickly ?

[reactvscode]

Unable to track an entity of type 'RefreshToken' because primary key property 'Token' is null..
when i run this it is showing this problem..what should i do?

[saurovk]

Nick, thanks much to infuse this knowledge. May I request a doubt-clarification. When a new user is authenticated with Uid/Pwd we generate the AccessToken&RefToken and persist the RefToinken in DB as in 20:15. Now what can we do at client side if the user comes the other day & pass credentials...if we again generate token there will be second entry of RefToken for the same user in the database...which we can't afford...Not very sure if the answer in hidden in your implementation. Thx