How to fix Error: TokenExpiredError: jwt expired in Node.js

const jwt = require('jsonwebtoken');

try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET);
  console.log('Token is valid:', decoded);
} catch (err) {
  if (err.name === 'TokenExpiredError') {
    console.log('Token expired at:', err.expiredAt);
    // Trigger token refresh or prompt re-authentication
    return { error: 'Token expired', code: 'TOKEN_EXPIRED' };
  } else if (err.name === 'JsonWebTokenError') {
    console.log('Invalid token:', err.message);
    return { error: 'Invalid token', code: 'INVALID_TOKEN' };
  }
  throw err;
}

// Generate access and refresh tokens
const accessToken = jwt.sign(
  { userId: user.id, email: user.email },
  process.env.JWT_SECRET,
  { expiresIn: '15m' } // Short-lived access token
);

const refreshToken = jwt.sign(
  { userId: user.id },
  process.env.REFRESH_TOKEN_SECRET,
  { expiresIn: '7d' } // Longer-lived refresh token
);

// Store refresh token in database
await prisma.refreshToken.create({
  data: {
    token: refreshToken,
    userId: user.id,
    expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
  },
});

// Send both tokens to client
res.json({ accessToken, refreshToken });

app.post('/api/auth/refresh', async (req, res) => {
  const { refreshToken } = req.body;

  try {
    // Verify refresh token
    const decoded = jwt.verify(refreshToken, process.env.REFRESH_TOKEN_SECRET);

    // Check if refresh token exists in database
    const storedToken = await prisma.refreshToken.findFirst({
      where: { token: refreshToken, userId: decoded.userId },
    });

    if (!storedToken) {
      return res.status(401).json({ error: 'Invalid refresh token' });
    }

    // Generate new access token
    const newAccessToken = jwt.sign(
      { userId: decoded.userId },
      process.env.JWT_SECRET,
      { expiresIn: '15m' }
    );

    res.json({ accessToken: newAccessToken });
  } catch (err) {
    res.status(401).json({ error: 'Invalid or expired refresh token' });
  }
});

// For high-security applications
const accessToken = jwt.sign(payload, secret, { expiresIn: '5m' });

// For standard web applications
const accessToken = jwt.sign(payload, secret, { expiresIn: '15m' });

// For mobile apps with less frequent API calls
const accessToken = jwt.sign(payload, secret, { expiresIn: '1h' });

// You can also use seconds
const accessToken = jwt.sign(payload, secret, { expiresIn: 900 }); // 15 minutes

try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET, {
    clockTolerance: 10, // Allow 10 seconds of clock skew
  });
} catch (err) {
  // Handle error
}

// Axios interceptor example
axios.interceptors.response.use(
  (response) => response,
  async (error) => {
    const originalRequest = error.config;

    // If error is 401 and we haven't retried yet
    if (error.response?.status === 401 && !originalRequest._retry) {
      originalRequest._retry = true;

      try {
        // Attempt to refresh the token
        const refreshToken = localStorage.getItem('refreshToken');
        const response = await axios.post('/api/auth/refresh', {
          refreshToken,
        });

        const { accessToken } = response.data;
        localStorage.setItem('accessToken', accessToken);

        // Retry original request with new token
        originalRequest.headers.Authorization = `Bearer ${accessToken}`;
        return axios(originalRequest);
      } catch (refreshError) {
        // Refresh failed, redirect to login
        window.location.href = '/login';
        return Promise.reject(refreshError);
      }
    }

    return Promise.reject(error);
  }
);