https://aripd.com/tags/authorization/ Recent content in Authorization on ARI Systems Hugo en-us ARI Systems Sat, 16 May 2026 06:19:44 +0000 https://aripd.com/blog/jwt/ Thu, 26 Nov 2020 00:00:00 +0000 https://aripd.com/blog/jwt/ <h2 id="references">References <a href="#references" class="permalink"><i class="bi bi-link-45deg"></i></a></h2><ul> <li><a href="https://jwt.io" target="_blank" rel="noopener noreferrer">jwt.io</a></li> <li><a href="https://github.com/jwtk/jjwt" target="_blank" rel="noopener noreferrer">jjwt</a></li> <li><a href="https://metamug.com/article/security/jwt-java-tutorial-create-verify.html" target="_blank" rel="noopener noreferrer">Generate JWT Token and Verify in Plain Java</a></li> <li><a href="https://medium.com/swlh/authentication-using-jwt-and-refresh-token-part-1-aca5522c14c8" target="_blank" rel="noopener noreferrer">Authentication Using JWT and Refresh Token</a></li> </ul> <h2 id="jwt-authentication-flow">JWT Authentication Flow <a href="#jwt-authentication-flow" class="permalink"><i class="bi bi-link-45deg"></i></a></h2><p><img src="./jwt-authentication-flow.svg" alt="JWT Authentication Flow" title="jwt authentication flow" class="img-fluid" loading="lazy" /></p> <p>The flow of the authentication process is:</p> <ol> <li>User logs in using their credentials. On a successful login, the server issues an access token which is valid for a certain period of time (say 10 minutes) and a refresh token with a longer lifetime (say 24 hours for apps dealing with sensitive data. Simpler apps can have for days or even months). The client (frontend) stores refresh token in local storage (not database) and access token in cookies.</li> <li>On every request to a protected resource, the access token must be provided in the request as a header.</li> <li>When the access token expires after the stipulated time (10 minutes in our case), the client side app sends a request to generate a new access token, using the refresh token. This continues throughout the lifetime of the refresh token.</li> <li>Once the refresh token is expired, the user will be logged out and needs to log in again.</li> </ol> <p>5 modules associated with the authentication process are:</p>