Timer-based jwt automatic renewal authentication method and system
By using a timer to automatically renew JWTs in the browser cache, the problems of high server load and high memory consumption in JWT renewal schemes are solved, and a simple and efficient token renewal process is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANGHAI WANXIANG BLOCK CHAIN CO LTD
- Filing Date
- 2022-07-06
- Publication Date
- 2026-06-02
AI Technical Summary
Existing JWT auto-renewal solutions store tokens on servers, resulting in high pressure, high memory consumption, and complex logic, which increases maintenance costs.
The system uses timer technology to automatically renew tokens before they expire. This is achieved by storing the token in the browser cache and using a timer-triggered function to retrieve the new token.
It effectively reduces server load and memory usage, simplifies the operation process, avoids the drawbacks of traditional JWT renewal schemes, and allows users to complete token renewal seamlessly.
Smart Images
Figure CN115270103B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of JWT authentication technology, and more specifically, to a timer-based method and system for automatic JWT renewal authentication. Background Technology
[0002] Currently, for JWT auto-renewal, most developers store the token in a database or Redis. This is more like a session and loses the essence of the token. It also puts pressure on the server, and if it is a server cluster, it will increase maintenance costs.
[0003] Patent document CN112260838B (application number: 202011103322.0) discloses an automatic renewal authentication method based on JWT. This method stores token records in a database, and each request requires decrypting the token, checking its existence in the database, comparing signatures multiple times, determining if the decrypted expiration time has expired, and checking if the remaining time is less than 3 minutes, etc. The logic is overly complex. Furthermore, storing the token in a database is somewhat like "reinventing the Session".
[0004] Patent document CN110995702B (application number: 201911215713.9) discloses a user authentication method, apparatus, server, and readable storage medium based on distributed microservices. The scheme includes: obtaining business requests carrying JWTs from the client side using an API gateway; extracting a token and user identification information from the JWT, and determining whether a mapping relationship between the two is recorded locally; if so, delaying the token's expiration time and responding to the business request using the API gateway; otherwise, rejecting the business request. It is evident that all business requests in this scheme are controlled through an API gateway, providing a unified entry point for user authentication. During the user authentication process, the mapping relationship between the token and user identification information is used to record the validity of the JWT, and the token is used to manage the JWT's validity period, improving the flexibility of the user authentication scheme. Summary of the Invention
[0005] In view of the deficiencies in the prior art, the purpose of this invention is to provide a timer-based JWT automatic renewal authentication method and system.
[0006] A timer-based JWT automatic renewal authentication method according to the present invention includes:
[0007] When a user logs in successfully, the storage backend returns a token, redirects the user to the content page, and starts a timer.
[0008] When the content page is refreshed, the storage backend returns a token, which starts a timer;
[0009] The function is executed based on a timer, and it checks whether the `renewal` value in the browser cache is true. If it is true, the refresh interface is called to obtain a new token to update the token in the browser's local cache, thus achieving automatic token renewal. If it is false, there is no token verification interface request, and no action is taken.
[0010] Preferably, the refresh interface is called to decode the user information based on the token stored in the browser cache, generate a new token, and return it to the front end. The front end stores the new token returned by the refresh interface in the browser cache and sets the value of refreshal in the browser cache to false.
[0011] Preferably, the front-end determines in the request interceptor whether the current request URL requires token verification and whether the refresh value in the browser cache is true. If the refresh value is false or undefined and the request URL requires token verification, then the refresh value stored in the browser cache is changed to true; otherwise, no action is taken.
[0012] Preferably, when the parameter loginTo is true, the current user has successfully logged in, the token returned by the backend is stored in the browser cache, the user is redirected to the content page, and a timer is started;
[0013] When the parameter loginTo is undefined, the current content page is refreshed, the refresh interface is called to obtain a new token, and the new token returned by the refresh interface is stored in the browser cache, and a timer is started.
[0014] Preferably, when a user logs out, the timer and browser cache are cleared.
[0015] According to the present invention, a timer-based JWT automatic renewal authentication system includes:
[0016] When a user logs in successfully, the storage backend returns a token, redirects the user to the content page, and starts a timer.
[0017] When the content page is refreshed, the storage backend returns a token, which starts a timer;
[0018] The function is executed based on a timer, and it checks whether the `renewal` value in the browser cache is true. If it is true, the refresh interface is called to obtain a new token to update the token in the browser's local cache, thus achieving automatic token renewal. If it is false, there is no token verification interface request, and no action is taken.
[0019] Preferably, the refresh interface is called to decode the user information based on the token stored in the browser cache, generate a new token, and return it to the front end. The front end stores the new token returned by the refresh interface in the browser cache and sets the value of refreshal in the browser cache to false.
[0020] Preferably, the front-end determines in the request interceptor whether the current request URL requires token verification and whether the refresh value in the browser cache is true. If the refresh value is false or undefined and the request URL requires token verification, then the refresh value stored in the browser cache is changed to true; otherwise, no action is taken.
[0021] Preferably, when the parameter loginTo is true, the current user has successfully logged in, the token returned by the backend is stored in the browser cache, the user is redirected to the content page, and a timer is started;
[0022] When the parameter loginTo is undefined, the current content page is refreshed, the refresh interface is called to obtain a new token, and the new token returned by the refresh interface is stored in the browser cache, and a timer is started.
[0023] Preferably, when a user logs out, the timer and browser cache are cleared.
[0024] Compared with the prior art, the present invention has the following beneficial effects:
[0025] 1. This invention uses timer technology to achieve automatic JWT renewal authentication. If a user operates the application within a time period, the front end will automatically renew the token for the user before it expires, without the user's awareness.
[0026] 2. This invention can effectively solve the problems of high server pressure, high memory usage, expired refresh tokens, and inability to filter expired JWTs that have not expired, which are common problems in traditional JWT renewal schemes;
[0027] 3. This invention achieves automatic JWT renewal by starting a timer when the token is generated and executing a function in the timer before the token expires to obtain a new token;
[0028] 4. This invention does not require server-side token storage, requires less code, and is simple to operate, effectively solving the drawbacks of traditional JWT renewal schemes. Attached Figure Description
[0029] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:
[0030] Figure 1 This is a flowchart of a timer-based JWT auto-renewal authentication method. Detailed Implementation
[0031] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the scope of protection of the present invention.
[0032] Example 1
[0033] This invention provides a timer-based method for automatic JWT renewal authentication, such as... Figure 1 As shown, it includes: a timed execution function that determines whether an API call is needed to obtain a new token, thereby updating the token in the browser's local cache and achieving automatic token renewal. This invention effectively solves the problems of high server load, high memory consumption, expired refresh tokens, and inability to filter expired JWTs in traditional JWT renewal schemes.
[0034] Specifically, including:
[0035] Step 1: When a user successfully logs in, store the token returned by the backend, redirect to the content page, and start a timer;
[0036] When the content page is refreshed, store the token returned by the backend and start a timer.
[0037] Step 1 includes the following steps:
[0038] Step 1.1: After successful user login, redirect to the content page and pass the `loginTo` parameter as `true` via routing (either as `state` or `query` parameters). Store the token returned by the backend (with an expiration time of T1) in the browser cache and start a timer.
[0039] Step 1.2: When the page refreshes, the timer cancels and restarts, but the token is still the same one returned during login; the two are not "synchronized." Therefore, the routing parameter `loginTo` passed after successful login is transmitted via (state or query), and will be lost during the refresh. Since the `loginTo` parameter is unavailable, the `refresh` interface is called to obtain a new token, at which point the token and the timer are now "synchronized."
[0040] In the component on the content page, check if the parameter `loginTo` is true. If not, call the `refresh` API to obtain a new token. (The `refresh` API will be called to obtain a new token when the content page is refreshed or when the tab is closed and the content page is accessed by entering a URL.) Store the token returned by the backend and start a timer.
[0041] Step 2: The frontend checks in the request interceptor whether the URL of the current request requires token verification and whether the `renewal` value in the browser cache is true. If the value of `renewal` is false or undefined and the requested URL requires token verification, then the value of `renewal` is stored as true in the browser cache; otherwise, no action is taken.
[0042] Step 3: Trigger the execution function based on the timer. The execution function checks if the `renewal` value in the browser cache is true. If it is true, the `refresh` interface is called, and the backend decodes the user information based on the previous token, generates a new token (valid for T1), and returns it to the frontend. The frontend stores the token in the browser cache. At this point, the value of `renewal` in the browser cache is set to false; if it is false, it means there are no token verification interface requests within T2, and no action is taken.
[0043] Step 4: If the user logs out, clear the timer, browser cache, etc.
[0044] This invention provides a timer-based JWT automatic renewal authentication system, comprising:
[0045] Module 1: When a user successfully logs in, store the token returned by the backend, redirect to the content page, and start a timer;
[0046] When the content page is refreshed, store the token returned by the backend and start a timer.
[0047] Module 1 includes the following modules:
[0048] Module 1.1: After a user successfully logs in, they are redirected to a content page. The `loginTo` parameter is set to `true` via routing (either as a state or query parameter). The token returned by the backend (with an expiration time of T1) is stored in the browser cache, and a timer is started.
[0049] Module 1.2: When the page refreshes, the timer cancels and restarts, but the token is still the one returned during login; the two are not "synchronized." Therefore, the routing parameter `loginTo` passed after successful login is transmitted via (state or query), and will be lost during the refresh. Since the `loginTo` parameter is unavailable, the `refresh` interface is called to obtain a new token, at which point the token and the timer are synchronized.
[0050] In the component on the content page, check if the parameter `loginTo` is true. If not, call the `refresh` API to obtain a new token. (The `refresh` API will be called to obtain a new token when the content page is refreshed or when the tab is closed and the content page is accessed by entering a URL.) Store the token returned by the backend and start a timer.
[0051] Module 2: The front-end checks in the request interceptor whether the URL of the current request requires token verification and whether the `renewal` value in the browser cache is true. If the value of `renewal` is false or undefined and the requested URL requires token verification, then the value of `renewal` is stored as true in the browser cache; otherwise, no action is taken.
[0052] Module 3: Execution function triggered by a timer. The function checks if the `renewal` value in the browser cache is true. If true, it calls the `refresh` API, where the backend decodes the user information based on the previous token, generates a new token (valid for T1), and returns it to the frontend. The frontend stores this token in the browser cache. At this point, the `renewal` value in the browser cache is set to false. If false, it means there are no token verification API requests within T2, and no further processing is done.
[0053] Module 4: If the user logs out, clear the timer, browser cache, etc.
[0054] Those skilled in the art will understand that, in addition to implementing the system, apparatus, and their modules provided by this invention in purely computer-readable program code, the same program can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system, apparatus, and their modules provided by this invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; alternatively, modules for implementing various functions can be considered both software programs implementing the method and structures within the hardware component.
[0055] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.
Claims
1. A timer-based JWT automatic renewal authentication method, characterized in that, include: When a user logs in successfully, the storage backend returns a token, redirects the user to the content page, and starts a timer. When the content page is refreshed, the storage backend returns a token, which starts a timer; The function is executed based on a timer, and it checks whether the `renewal` value in the browser cache is true. If it is true, the refresh interface is called to obtain a new token to update the token in the browser's local cache, thus achieving automatic token renewal. If it is false, there is no request for a token verification interface, and no action is taken. In the request interceptor, the front-end checks whether the URL of the current request requires token verification and whether the refresh value in the browser cache is true. If the refresh value is false or undefined and the URL of the request requires token verification, the refresh value stored in the browser cache is changed to true; otherwise, no action is taken. When the parameter loginTo is true, the current user has successfully logged in, the token returned by the backend is stored in the browser cache, the user is redirected to the content page, and a timer is started. When the parameter loginTo is undefined, the current content page is refreshed, the refresh interface is called to obtain a new token, and the new token returned by the refresh interface is stored in the browser cache, and a timer is started.
2. The timer-based JWT automatic renewal authentication method according to claim 1, characterized in that, The refresh API is called to decode the user information based on the token stored in the browser cache, generate a new token, and return it to the front end. The front end stores the new token returned by the refresh API in the browser cache and sets the value of refreshal in the browser cache to false.
3. The timer-based JWT automatic renewal authentication method according to claim 1, characterized in that, When a user logs out, the timer and browser cache are cleared.
4. A timer-based JWT automatic renewal authentication system, characterized in that, include: When a user logs in successfully, the storage backend returns a token, redirects the user to the content page, and starts a timer. When the content page is refreshed, the storage backend returns a token, which starts a timer; The function is executed based on a timer, and it checks whether the `renewal` value in the browser cache is true. If it is true, the refresh interface is called to obtain a new token to update the token in the browser's local cache, thus achieving automatic token renewal. If it is false, there is no request for a token verification interface, and no action is taken. In the request interceptor, the front-end checks whether the URL of the current request requires token verification and whether the refresh value in the browser cache is true. If the refresh value is false or undefined and the URL of the request requires token verification, the refresh value stored in the browser cache is changed to true; otherwise, no action is taken. When the parameter loginTo is true, the current user has successfully logged in, the token returned by the backend is stored in the browser cache, the user is redirected to the content page, and a timer is started. When the parameter loginTo is undefined, the current content page is refreshed, the refresh interface is called to obtain a new token, and the new token returned by the refresh interface is stored in the browser cache, and a timer is started.
5. The timer-based JWT automatic renewal authentication system according to claim 4, characterized in that, The refresh API is called to decode the user information based on the token stored in the browser cache, generate a new token, and return it to the front end. The front end stores the new token returned by the refresh API in the browser cache and sets the value of refreshal in the browser cache to false.
6. The timer-based JWT automatic renewal authentication system according to claim 4, characterized in that, When a user logs out, the timer and browser cache are cleared.