How is the JWT created

Question

I am using the OWIN authentication middleware that comes with Identity Framework in an ASP.Net Web API. I was wondering what code is being executed in the Web API to create the Bearer Token? And once the JWT is created where is it stored. Also can I set the JWT to never expire? Thanks !

Answer 1

The middleware only validates the token.

The oauth authorization server assigns the token. The configuration of this server controls the expiration. For example, with azure ad, you can configure up to 2 hours. Refresh tokens can have longer lifetimes.

The client calling the middleware stores the token. The client library is configured for storage.

Note: if the middleware makes a new request with a bearer token, it uses the passed bearer token plus its own credentials to call the oauth server to get a new access token.