# Remove expiration from JWT

**URL:** https://discourse.nodered.org/t/remove-expiration-from-jwt/47750
**Category:** General
**Created:** [28 June 2021 16:02 UTC](https://discourse.nodered.org/t/remove-expiration-from-jwt/47750 "2021-06-28T16:02:49Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![torrent](https://avatars.discourse-cdn.com/v4/letter/t/4bbf92/32.png) [@torrent](https://discourse.nodered.org/u/torrent)
#### Post date: [28 June 2021 16:02 UTC](https://discourse.nodered.org/t/remove-expiration-from-jwt/47750/1 "2021-06-28T16:02:50Z")

</div>

I am trying to create jwt from json data. The problem is, I am using this node

> **[node-red-contrib-jwt](https://flows.nodered.org/node/node-red-contrib-jwt)**
>
> JWT Validator and Signer

and it always creates a jwt with iat (issue at) and exp (expiration) like this:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/b/b/bb4e60d402f0bf9e3400af0a7b52e7c83d1edec5.png)

Question is: how can I remove iat and exp from jwt?

---

<div class="post-metadata">

### Author: ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [28 June 2021 16:52 UTC](https://discourse.nodered.org/t/remove-expiration-from-jwt/47750/2 "2021-06-28T16:52:32Z")

</div>

In a Change node you can Delete properties by selecting Delete.

---

<div class="post-metadata">

### Author: ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [28 June 2021 18:36 UTC](https://discourse.nodered.org/t/remove-expiration-from-jwt/47750/3 "2021-06-28T18:36:03Z")

</div>

Be careful, JWT's are _meant_ to be short lived. Remember that they are just a convenience and not a security feature. They are really meant to be used to allow one server to hand off to another (that was the original design criteria) and as such should have timespans in minutes.

Sadly, a large number of developers have abused them but not recognised the weaknesses.

If you need session management, use a session management tool and retain JWT as the short-lived convenience token it is meant to be.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)
#### Post date: [27 August 2021 18:36 UTC](https://discourse.nodered.org/t/remove-expiration-from-jwt/47750/4 "2021-08-27T18:36:49Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.