title: JWT & client and server time
body: <p>I honestly cannot find an answer I am looking for, so here is a problem I am struggling with,</p>
  <p>let me just say one thing, if what I am about to say is a total shit, please do let me know, but still solution I am after would be nice as well</p>
  <p>tldr: it's not safe to compare client date with jwt.exp in order to find out whether it jwt is expired</p>
  <p>let's look at typical react(client) and nodejs(server) example, where JWT access token gets inserted into a request header in order get data from protected API route,</p>
  <ul>
  <li>client sends a request to a server to log in,</li>
  <li>server returns access token(e.g. valid for 2 minutes) in the response and creates a cookie with refresh token(e.g. valid for a day) - both tokens are created based on server time</li>
  </ul>
  <p>now imagine that time on server is 3PM, on the client 1PM
  <strong>not because of the timezone</strong> -  client and server are both in the same timezone, client system clock is simply 2 hours behind for any reason</p>
  <p>so now, user is logged and client can add access token into the request header</p>
  <p>after 3 minutes another request is sent with access token in the header to get some secret data,
  request gets intercepted on the client, before it hits the server to check jwt.exp in case slient JWT refresh is needed</p>
  <p>so it runs</p>
  <p>if Date.now() &gt; JWT.exp</p>
  <p>it will return false, 1:03pm <strong>is not</strong> &gt; then 3:03pm</p>
  <p>if false -&gt; no need to do the silent token refresh</p>
  <p>but since the access token is valid only for 2 minutes request obviously fails</p>
  <p>scenario where server time is behind the client take, potentially makes access token valid for way longer that it should actually be valid</p>
  <p>now, am I a total idiot? or I am right thinking that when it comes to check JWT.exp, it should be compared with the server time, because server created the token,</p>
  <p>thanks for reading it</p>