title: JWT Token authentication, expired tokens still working, .net core Web Api
body: <p>I'm building a .net core web api.</p>
  
  <p>Preface - I've implemented token authentication as per <a href="https://stormpath.com/blog/token-authentication-asp-net-core" rel="noreferrer">https://stormpath.com/blog/token-authentication-asp-net-core</a> and <a href="https://dev.to/samueleresca/developing-token-authentication-using-aspnet-core" rel="noreferrer">https://dev.to/samueleresca/developing-token-authentication-using-aspnet-core</a>. I've also read a few issues on github and here on SO.</p>
  
  <p>This also came in handy <a href="https://goblincoding.com/2016/07/24/asp-net-core-policy-based-authorisation-using-json-web-tokens/" rel="noreferrer">https://goblincoding.com/2016/07/24/asp-net-core-policy-based-authorisation-using-json-web-tokens/</a>.</p>
  
  <p>After implementing it all I'm feeling like I'm missing something.</p>
  
  <p>I've created a simple Angular application that sits in a web client. When I authenticate, client is sent a token. I'm storing that in session for now (still in dev so will address security concerns around where to store it later).</p>
  
  <p>Not really sure this (<a href="https://stackoverflow.com/questions/26739167/jwt-json-web-token-automatic-prolongation-of-expiration">JWT (JSON Web Token) automatic prolongation of expiration</a>) is useful as I haven't implemented refresh tokens as far as I can see.</p>
  
  <p>I noticed that when I call logout, and then log back in again, the client is sent a new token - as expected. However, if the token expiry time is passed (I set it to 1 minute for testing) and then the page is refreshed, the token seems to remain the same in my app. <strong>i.e. it's as if the token never expires?!</strong></p>
  
  <p><strong>I would have expected the client to be returned a 401 Unauthorised error and I can then handle forcing the user to re-authenticate.</strong></p>
  
  <p><strong>Is this not how this should work?</strong> Is there some auto-refresh token magic going on in the background that is default (I haven't set up any notion of refresh tokens in the tutorials explicitly)? Or am I missing something about the concept of token auth?</p>
  
  <p>Also - <strong>if this is a perpetually refreshing token, should I be concerned about security if the token was ever compromised?</strong></p>
  
  <p>Thanks for your help</p>