kannandk's avatar

how to give expiration time in sanctum

i made user login route and created a token for the user so after 10 mins the token should expire , so how and where should i set the expiration time for the token .

i did tried giving 'expiration' => 1 , in the config/sanctum.php file but its not working

0 likes
10 replies
Nakov's avatar

So did you changed the settings after you created the token, or you first changed the settings and then created the token?

https://laravel.com/docs/9.x/sanctum#token-expiration

You will have to schedule the command or run it in order for the token to be revoked, otherwise it will still be used.

1 like
kannandk's avatar

@Nakov hi ,

i did changed the setting first and then created the token , i did visited the laravel page, i am asking like if i created a token its gonna create a record in the personal access tokens table, there in the expires_at column the date of expiration should be given right, so that the token will expire after that time . so how should i set the value for that (expires_at ) column when creating a token .

also schedule command is to delete the expired token records in the table - right? (correct me if am wrong!).

Nakov's avatar

@kannandk Yes, that's why the schedule command is for. And isn't the expires_at column filled in?

1 like
kannandk's avatar

@Nakov when installing sanctum it creates the migration file for personal_access_tokens table right so it uses the default model for this table . i did not create any model file by default the expires_at column is given nullable , when i try to create token its comes null for the column

Nakov's avatar

@kannandk can you run php artisan config:clear and delete all tokens, and create a new one.

You've used this: php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider" to publish the config right, so you are changing your config file, not the vendor one?

1 like
Nakov's avatar

@kannandk okay my friend, if you can share some code on how you are issuing the token and anything that will be helpful for me or anyone else to help you it will be best. Otherwise I can keep on guessing and giving you things to try blindly.

1 like
kannandk's avatar

@Nakov

migration file

public function up()
{
    Schema::create('personal_access_tokens', function (Blueprint $table) {
        $table->id();
        $table->morphs('tokenable');
        $table->string('name');
        $table->string('token', 64)->unique();
        $table->text('abilities')->nullable();
        $table->timestamp('last_used_at')->nullable();
        $table->timestamp('expires_at')->nullable();
        $table->timestamps();
    });
}

default model created for personal access tokens table

{ protected $casts = [ 'abilities' => 'json', 'last_used_at' => 'datetime', 'expires_at' => 'datetime', ]; protected $fillable = [ 'name', 'token', 'abilities', 'expires_at', ]; protected $hidden = [ 'token', ]; public function tokenable() { return $this->morphTo('tokenable'); } public static function findToken($token) { if (strpos($token, '|') === false) { return static::where('token', hash('sha256', $token))->first(); }

    [$id, $token] = explode('|', $token, 2);

    if ($instance = static::find($id)) {
        return hash_equals($instance->token, hash('sha256', $token)) ? $instance : null;
    }
}
public function can($ability)
{
    return in_array('*', $this->abilities) ||
           array_key_exists($ability, array_flip($this->abilities));
}
public function cant($ability)
{
    return ! $this->can($ability);
}

}

in sanctum config file i only changed the 'expiration' =>10,

the controller file

	 public function login(Request $request)  {
    		$employee = Employee::where(['userName' => $request->userName, 'password' => $request->password])->first();
    		if(!$employee || Hash::check($request->password, $employee->password)) {
        		return response()->json("check userName or password", 404, ['content-type' => 'text/json']);
    		}
    		if($employee->tokens()->where('tokenable_id', $employee->id)->exists()) {
        		$employee->tokens()->delete();
   		 }
    		$token = $employee->createToken($request->userName)->plainTextToken;
    		$response =[
        		'employee' => $employee,
        		'token' => $token
			];
    		return response()->json($response, 200, ['content-type' => 'text/json']);
}
kannandk's avatar

@Nakov thanks dude i got it i was gave the expiration in the wrong config file now i changed it to the default config so the expiration works.

Please or to participate in this conversation.