Hello guys I started using memberstack I am getting the JWT token from my react application and I need to use this Jwt token in my backend my backend is validating this token I would like to know if you know where I can find more information about this scenario? I tried in different ways, but I am getting some errors and I cannot find the solution thank you
How to manage Memberstack JWT token validation and expiration in a React-backend setup?
Answered
8 comments
Hello Ricardo 👋🏼
Happy Monday! Hopefully your weekend went well 😁
Here’s our article on verifying JWTs on the back-end: https://docs.memberstack.com/hc/en-us/articles/7253255689755-Using-Permissions-and-Token-Verification-to-Secure-Your-Site
What errors are you hitting? Can you share a loom.com video
hi guys i still beginner in developing app using webflow, memberstack, and make.com (I'm solo builder btw)
someone ever told me to make backend secure is using token and i saw memberstack already implement token on localstorage.
so the question is how long the expire time of memberstack token?
how to handle if the token was expired?
thank you
In the server you will return a 401 or 403 status code if the token has expired.
The days of the expiring session are handled in the Memberstack Dashboard
Hi. Are memberstack jwt long lived by default? I see 14d. Do they rotate or stay active until expiry? And do you guys provide any way to refresh/rotate token if needed?
Hey Sim Sidhanti,
You can set the session duration as per your requirement for the project.
And for the refresh functionality, you can checkout the 'Session Refresh' section in the Session Management and see if that works for your project.
Lifetime: Yes — by default a member's JWT is valid for 14 days. That's configurable on your app (the "session duration" setting), so you can shorten or lengthen it.
Rotation: They don't rotate. Once issued, a token stays valid until it expires — there's no sliding window or background refresh, and the same token is used for the life of the session.
Refreshing: We don't currently expose a token-refresh/rotate endpoint. To get a fresh token, the member simply logs in again (via the SDK's login methods), which issues a new 14-day token. If you'd like tighter control, you can lower the session duration, and we also offer a "disable concurrent logins" option that invalidates older tokens when a member signs in again
Oh Tyler Bell, is the refresh functionality not available?
I was wondering what this session refresh method does in that case 🤔?
A J That functionality doesnt do anything.
The only write operation it does is to look for an element that has a specific id and write the new expiry date. It's possible that that element doesn't exist (as it's not part of the tutorial) so it will throw an undefined error in the console. Also that parse JWT function is possible that doesn't exist either, it will fail as well.
It should be removed from the documentation. As Memberstack sessions are stateless, can't be modified after creation.
Please sign in to leave a comment.