I'm making a mobile application, and I use JSON Web Token Authentication (JWT Auth), but I have three questions about:

  1. Should I use refresh-tokens or non-expiring access tokens?
  2. In case I use refresh-tokens, when the token expires, should I sign out the user (and force the user to login again) or create a new one and send it back to the app so it can be used for future requests?
  3. How should I save the token on the mobile (database, preferences,etc.)?

Any help and resource about this (books,documents,blog,etc.) would be appreciated, thanks in advance!


1.In case you have a "remember me" option in your page you should use the non-expiring token. Otherwise ,in my opinion you should use the refresh one.

2.Token expiration should be handled by asking the user to login again. The tricky part is when the token expires while the user is in the middle of something .In that case you should try remembering what action he was trying to do before the token expired and allow him to continue once he has logged in again.

3.You could use local storage for storing tokens. You can set it to a variable in the storage once authentication is complete and there after keep appending that storage value to the http header of every subsequent protected web service request.

  • Hi Rahul, thanks for your answer, my mother tongue is spanish, my english is good enough to understand what you wrote, but there are other people which won't understand what you wrote, so consider write it well, please :D – Victor Castillo Torres Feb 1 '15 at 5:17
  • There tried to make it better ;).I'm typing from my cellphone so auto correct never really works that well.I should have read and edited my answer before posting though. My bad :) – Rahul Ravindran Feb 1 '15 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.