Yii2 Rest Api User bearer Authentication expiration time

Question

i am currently working on a yii2 based Rest api. i use bearer token for user authentication.let me explain the requirement.

1)first user authenticated from a external php application using their credentials.

2)he/she got an access Token.

3)each subsequent request is made using this access token.

public static function findIdentityByAccessToken($token, $type = null)
{
    return static::findOne(['auth_key' => $token]);
}

this is where i start thinking. i do not found any expiration time for the access token. is that really needed? if yes how can i archive that? Thanks in advance.

As far as I know Yii will not have auth token expiration time by default. we have to implement externally. Please correct me if I am wrong and please refer this link it may helpful to you - http://stackoverflow.com/questions/25327476/implementing-an-restful-api-authentication-using-tokens-yii-yii2 — Manikandan S, Mar 13 '17 at 12:22
I did much the same thing a while back, and found that JWT's worked well. You can define a time out in the token, and its signed so i should not be possible to tamper with. — Jørgen, Mar 13 '17 at 12:32

deacs · Accepted Answer · 2017-03-14T08:10:25.553

Your question is kind of broad, but I will attempt to help your thought process along.

i do not found any expiration time for the access token. is that really needed?

That depends on your requirements. Do you want your users to be able to access your API indefinitely after authenticating the first time? Would you like your users to renew their token every so often?

I would recommend the latter, as it limits the time a potential attacker could use a compromised access token.

if yes how can i archive that?

One option would be to add a field containing the datetime of the expiry date to the database table corresponding with your identity class and to check wether this is still valid in the implementation of findIdentityByAccessToken()

public static function findIdentityByAccessToken($token, $type = null)
{
    return static::findOne([
        'AND', 
        ['auth_key' => $token], 
        ['>=', 'token_expire', new \yii\db\Expression('NOW()')]
    ]);
}

Yii2 Rest Api User bearer Authentication expiration time

1 Answers1

Linked