title: JsonWebToken: activity-based expiration vs issuing time-based expiration
body: <p>I'm fairly new to token based authorization. I'm trying to find the flaws in a custom expiration/token-refresh scheme.</p>
  
  <p>I have a basic JWT auth setup in an Express API; I'm setting the JWT expiration to 1 hr; However, JWT checks token expiration relative to the time the token was issued.  I would prefer that the expiration time gets reset after each successful api call. If my user is actively using the app for more than an hour, I don't want them to have to log back in to refresh the token (and possibly lose whatever data they are working on.)</p>
  
  <p>On the the other hand, I do want the token to expire if they are not responsive for more than an hour.</p>
  
  <p>I have come up with the following approach:</p>
  
  <blockquote>
    <p>During every successful API request, issue a new JWT and send it in a
    custom response header.  My client side code is responsible for
    checking this JWT response header and using its value as the new default Authorization request header.  Thus, if there is no API 
    request from the user for more than 1 hour, the token will expire and
    not be refreshed. Login would then be required. In addition, the original issue-date of the token (timestamp of login-authentication) will be stored so that a "hard-expiration" of the token will be enforced after 24 hours.</p>
  </blockquote>
  
  <p>This seems fairly straightforward and reasonably secure, but I haven't seen any reference to it in my JWT research.  Is there a better way to achieve the same goal?  Am I missing a major security hole with this approach?</p>
  
  <p><strong>UPDATE:</strong>
  After thinking of this for some time, I realized that the problem with this is that it opens the door to replay attacks that could not be thwarted by token expiration. So there should absolutely be a "hard-expiration" check: hard expiration would invalidate the token at some time after issue date, regardless of recent user activity.</p>