JSON Web Tokens vs. Sessions
For people using JWT as a substitute for stateful sessions, how do you handle renewal (or revocation)?<p>With a traditional session, the token is set to expire after some period of inactivity (e.g. one hour).  Subsequent requests push out the expiration... so that it's always one hour <i>from the last activity</i>, rather than one hour <i>from initial authentication</i>.<p>With JWT, the expiration time is baked into the token and seems effectively immutable.  To extend the session, you have to either:<p>1. Re-authenticate from the browser every hour and store a new JWT token, which is kind of an awful user experience, or<p>2. Renew the JWT token from the server side every hour.  At least in Google's implementation, this requires the user to grant "offline access" (another awful user experience)... and you'd need some hacky approach for replacing the JWT token in the user's browser.<p>So with all the recent discussion about not using JWT for sessions, what do you guys do?  Do you simply make users re-authenticate every hour?  Is there another magic trick that no one has brought up?<p>In my own shop, we're using the browser's JWT token as a server-side cache key... and storing the "real" expiration in cache so that it can be extended (or revoked) as needed.  I would be interested to know if others take a similar approach, or have issues with that?