How to extract JWT Expiry date without resource server? - authentication

Question

I have a Single Page Application which requests JWTs from AWS cognito to access protected resources in a resource server. However, when the JWT expires, I would like to programmatically refresh it. To do this, I need to know if the token is expired to trigger a refresh. Here is the JWT below.
{
"sub": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"aud": "xxxxxxxxxxxxexample",
"email_verified": true,
"token_use": "id",
"auth_time": 1500009400,
"iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_example",
"cognito:username": "janedoe",
"exp": 1500013000, // <---- this is what we want
"given_name": "Jane",
"iat": 1500009400,
"email": "janedoe#example.com"
}
My dilemma however is that I do not know how to check when it expires without sending it to the resource server to validate it and I cannot do validation on front end as that would expose application secrets. I figure the exp variable is possibly the number of milliseconds from a particular date, however I'm not sure (and nothing on Google corroborates this).
So I'd like to ask, how does one determine the expiry date from the exp variable?

Answer 1

The exp claim is indeed what you're looking for. It's the expiration time, encoded as a numeric value representing the number of seconds since 1970-01-01 00:00 UTC (also refered to as UNIX Epoch time)
You can check your token on https://jwt.io/ and see the converted timestamp, if you point with the mouse on the numeric timestamp.
Here's a small js snippet, that demonstrates how you can calculate the remaining time:
// exp = 2019-09-01 00:00 UTC
var exp = 1567296000
var currentTimeSeconds = Math.round(+new Date()/1000);
console.log(currentTimeSeconds)
var remainingSeconds = exp - currentTimeSeconds
console.log(remainingSeconds + " seconds remaining")
and here is how to convert it to date type, output in local time:
// exp = 2019-09-01 00:00 UTC
var exp = 1567296000
var expDate = new Date(exp*1000);
var expYear = expDate.getYear() + 1900
var expMonth = expDate.getMonth() + 1
var expDay = expDate.getDate()
var expHours = "0" + expDate.getHours()
var expMinutes = "0" + expDate.getMinutes()
var expSeconds = "0" + expDate.getSeconds()
var expFormatted = expYear + "-" + expMonth + "-" + expDay + " " + expHours.substr(-2) + ':' + expMinutes.substr(-2) + ':' + expSeconds.substr(-2);
console.log(expFormatted)

Answer 2

Cognito provides some standard session validation in their libraries.
If you're using JavaScript, you can get a valid set of tokens using
CognitoUser.getSession((err, session) => {
...
})
This checks the id and access tokens and if either is expired, will retrieve updated tokens using the refresh token.