Google Wallet JWT expiration

Question

I'm making my first html5 game with in app purchases using google wallet and java with jsp to generate my jwt token for the purchase.

My game operates entirely on a single page, which the end user may be on for a prolonged period of time during gameplay. Right now I have my JWT tokens expire after 60 seconds, and allowing users to purchase in only 60 seconds is simply unacceptable.

The easiest solution seems to be to up the expiry to something like perhaps an hour. Is there a con to doing so? Is it possible, and would it be better, for me to load the tokens from another web address without redirecting the page, so that I could get the tokens whenever the user opens the store in game?

Answer 1

You should generate the tokens when the user opens the in-game store. Allowing for a 5-10 minutes expiration is ok.

Ajax is a good way to do it. You can also have a look at the samples page below for more examples:

https://developers.google.com/commerce/wallet/digital/docs/samples