What is the best way to check the expiration date of a JWT token?

Question

We are building an app and we need to check the JWT token expiration. The question is can we do this from the app side or should the backend handle this?

Note: We are building the application in Flutter.

Sachin Singh · Answer

follow this for flutter main () { String yourToken = Your JWT; bool hasExpired = JwtDecoder.isExpired(yourToken); // You will get a true / false response // true: if the token is already expired // false: if the token is not expired } follow below link https://pub.dev/packages/jwt_decoder

Deepak Tewatia · Answer

Hi sarfaraj It is generally recommended to handle the expiration of JSON Web Tokens (JWTs) on the backend side rather than the client side. This is because JWTs are signed by the server and contain information that the client should not be able to modify. If you want to handle the expiration of JWTs on the client side it would be possible for a malicious user to tamper with the JWT and extend its expiration time. On the backend side you can set an expiration time when you issue the JWT to the client. The client can store the JWT and send it back to the server with each subsequent request. The server can then verify the JWT and check its expiration Date Time before processing the request. If the JWT has expired the server can return an appropriate error response to the client. In your case When making subsequent requests to the backend retrieve the JWT from storage and include it in the Authorization header of the request. Thanks

Aravind Govindaraj · Answer

I prefer to go with Server Side. Make common methods for all the rest API calls and then when the token expires apply refresh token logic...

Tuhin Paul · Answer

Checking the expiration of a JWT token should ideally be done on both the client-side and server-side. On the client-side you can check the expiration of the token before making any API requests that require authentication. This can help prevent unnecessary API calls and improve the overall performance of your app. Note that JWT tokens can be manipulated or spoofed on the client-side so relying solely on client-side checks for token expiration can be a security risk. It is essential to also have token expiration checks on the server-side. This helps ensure that any API requests that require authentication are only accepted if the JWT token is still valid.