What is the max expiration time accepted by JWT to

问题:

I want to know what is the max value I can set of the JWT token expiration.

Thanks!

回答1:

There is no rule about the expiration time. It mainly depends on the context where the token is used.

RFC7519 section 4:

The set of claims that a JWT must contain to be considered valid is context dependent and is outside the scope of this specification.

Thus you can consider that for critical processes, a short lifetime may be needed (only few seconds or minutes). For trivial contexts, one month lifetime, one year or even a token without expiration time could be acceptable.

回答2:

the maximum allowed age for tokens to still be valid. It is expressed in seconds or a string describing a time span zeit/ms. Eg: 1000, "2 days", "10h", "7d". A numeric value is interpreted as a seconds count. If you use a string be sure you provide the time units (days, hours, etc), otherwise milliseconds unit is used by default ("120" is equal to "120ms").There is no maximum limit.