Is anyone here already rotating the JWT Secret?

[jansgescheit]

Is anyone here already rotating the JWT Secret?

If so, how do you go about it? In the best case, so that the user does not have to log in again when the key was rotated.

I have imagined that in the token refresh a token with a new signature is delivered. This assumes of course that the token decoder knows the old and new secret. Which can be problematic with a compromised old secret.

[leon0399]

Yes! In my case I use 60 min ttl and following code to refresh the token:

    // Controller

    /**
     * Refreshes a JWT (ie. extends it's TTL)
     */
    public function refresh(): Response
    {
        return $this->respondWithToken($this->guard->refresh());
    }

// api.php

Route::middleware('jwt.check')
    ->post('refresh', [AuthController::class, 'refresh'])->name('token.refresh');

But yes, it doesn't solve the problem if the old jwt has been obtained by 3rd-party

Having separate auth and refresh token was previously discussed and was considered as one of future features

[jansgescheit]

@leon0399 you're just describing updating an expired user token, right? I want to regularly rotate the JWT_SECRET. With a separate refresh token the rolling would be much easier of course.