JWT Access and Refresh Token Expiration

I currently have the following expiration life times set.

.SetAccessTokenLifetime(TimeSpan.FromMinutes(1))
.SetRefreshTokenLifetime(TimeSpan.FromMinutes(5))

Access Token Not Expiring

The access_token returned is ok which is a JWT. The decoded JWT has a valid exp claim. It should expire in a minute. I also get expires_in: 60 from my token endpoint. However after a minute it just doesn’t expire. I have even checked the timestamp on the exp claim and the current UTC timestamp is already way beyond the exp claim.

Shouldn’t the OpenIddict Authorization Middleware decode that JWT access_token and see that the token has already expired and return a 401 Unauthorized?

At some point it expires but not in 1 minute which I have set. I don’t know how it decides if the token is already expired.

I am putting this attribute to my endpoints that I wanted secured. Is there a special one to be used for JWT?

[Authorize(ActiveAuthenticationSchemes = OAuthValidationDefaults.AuthenticationScheme)]

Refresh Token Expiration

How does the refresh token expire? It is not a JWT and there is no table to track these tokens . The only thing I understand about the OpenIddictToken table is it whitelists refresh tokens that can be used. I however prefer a blacklist. Can you give me some implementation details regarding the refresh token?

[kevinchalet]

Do you include that id inside that refresh_token using the encryption algorithm you mentioned above?

Yep: https://github.com/openiddict/openiddict-core/blob/dev/src/OpenIddict.Core/Infrastructure/OpenIddictProvider.Serialization.cs#L34-L42

[kevinchalet]

For the access token I know that it uses the exp claim because it is a JWT. But for the refresh token I have no idea how it is done?

The expiration date is stored as an authentication property inside the refresh token (which is encrypted using an authenticated encryption algorithm).

You can find the corresponding code in the aspnet/Security repo, which owns the ticket serializer used by OpenIddict for access tokens (when using the default format), authorization codes and refresh tokens: https://github.com/aspnet/Security/tree/dev/src/Microsoft.AspNetCore.Authentication/DataHandler

The “expiration” check is directly made by ASOS, the underlying OIDC framework used by OpenIddict: https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/blob/dev/src/AspNet.Security.OpenIdConnect.Server/OpenIdConnectServerHandler.Exchange.cs#L257

The corresponding test can be found here: https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/blob/dev/test/AspNet.Security.OpenIdConnect.Server.Tests/OpenIdConnectServerHandlerTests.Exchange.cs#L489-L524