title: ASP.NET Core and JWT token lifetime
body: <p>I utilize <code>ASP.NET Core 2.1.1</code></p>
  
  <p>It is interesting that the expiration time is only being taken into account when one provides <strong>both</strong> <code>ClockSkew</code> - <em>in Startup.cs</em> <strong>and</strong> <code>JwtSecurityTokenHandler.TokenLifetimeInMinutes</code> - <em>in a controller</em>.</p>
  
  <p>For instance:</p>
  
  <pre><code>services
    .AddJwtBearer(x =&gt;
    {
        ...
        x.TokenValidationParameters = new TokenValidationParameters()
        {
           ClockSkew = TimeSpan.FromMinutes(90),
           ...
  </code></pre>
  
  <p>plus</p>
  
  <pre><code>...
  public async Task&lt;AuthenticateOutput&gt; Authenticate([FromBody] AuthenticateInput input)
  {
     var tokenHandler = new JwtSecurityTokenHandler();
     tokenHandler.TokenLifetimeInMinutes = (int)TimeSpan.FromMinutes(90).TotalMinutes;
     ...
  </code></pre>
  
  <p>If I remove <code>tokenHandler.TokenLifetimeInMinutes = (int)TimeSpan.FromMinutes(90).TotalMinutes;
  </code> part - the default expiration time is used.</p>
  
  <p>It seems to me that <code>tokenHandler.TokenLifetimeInMinutes</code> is <strong>still</strong> redundant and I just misunderstand the concept of how to set the expiration time correctly.</p>
  
  <p>I also tried adding expiration claim - <code>new Claim(ClaimTypes.Expiration, ...)</code> - but that didn't have much effect.</p>