Odtnhj

I am using the hybrid flow with the refresh token. I want to limit the calls from my web server to my Auth/Resource servers i.e. unauthorized errors from the resource server and unnecessary updates of the access token

Question:
Is there an expiry date on the access token or a way to add the expiry or issued date time to the Access token? I want to use this to test before refreshing the tokens.

I want to do this validation on the webserver. I just need the issued date on the access token

I do understand that the expiry date is not full proof and the token may still be invalid but I can cater for that scenario when it arises.

Thank you

The web server is the client. The client can read the expiration time (which is already part of the access token) like this:

using System.IdentityModel.Tokens.Jwt;

public class HomeController : Controller


 public async Task<IActionResult> CallApiUsingUserAccessToken()
 
 var accessToken = await HttpContext.GetTokenAsync("access_token");

 // Read expiration time
 var tokenHandler = new JwtSecurityTokenHandler();
 var jwtSecurityToken = tokenHandler.ReadJwtToken(accessToken);

 var validTo = jwtSecurityToken.ValidTo;

 // ...
 

I've just added the lines concerning reading the expiration time. HomeController is part of the MvcClient project which is available in the 5_HybridFlowAuthenticationWithApiAccess sample.

The client configuration allows for the following properties to be set regarding access token lifetime:

AccessTokenLifetime: Lifetime of access token in seconds

AbsoluteRefreshTokenLifetime: Max lifetime of a refresh token

RefreshTokenExpiration: Fixed time expiration (has both absolute and sliding options)

Here is the documentation around this:
http://docs.identityserver.io/en/release/reference/client.html