Refresh expired jwt in browser when using Google Sign-In for Websites

Question

I largely followed this tutorial on how to do client authentication with Google Sign-In, get a JWT, and verify the JWT on the server on each request using Google's tokeninfo endpoint.

Everything works great except the tokens expire after 60 min and I don't know how to refresh the token.

Answer 1

The API server should not be involved in this refresh. The client is responsible for getting a refreshed token from the authentication service (google in this case) but there is no documentation on how to do that that I've found.

What I've observed is that the id_token is actually automatically updated by the gapi library before expires_at passes, usually about 5min before.

authInstance = gapi.auth2.getAuthInstance()
currentUser = authInstance.currentUser.get()
authResponse = currentUser.getAuthResponse()

You can then get the id_token and expired_at by doing:

authResponse.id_token
authResponse.expires_at

You can monitor for this update by doing:

authResponse.listen(function (gUser) {
  const jwt = gUser.getAuthResponse().id_token
  // ...you now have an updated jwt to send in all future API calls
}