Your JWT lasts 7 days. Here’s What Happens When Someone Steals It.

This article explores the issue of JWT token security and how it can be compromised when a hacker steals the token. After logging into an application, the Spring Boot API generates a JWT that remains valid for seven days. If someone manages to steal the token, the user changing their password immediately may not solve the problem, as the stolen JWT can still be valid until it expires.

The biggest drawback of stateless JWT authentication is that once a token is stolen, it can remain valid until it expires. To address this issue, refresh token rotation is recommended. This means that every successful refresh of the access token replaces the old refresh token with a new one. For example, if the attacker steals a refresh token, the server can revoke it and issue a new one, preventing the stolen token from being used again.

However, refresh token rotation is not without its challenges. Refresh tokens should be stored as httpOnly, secure cookies that cannot be accessed by JavaScript, and the access token should be kept in memory rather than written to disk. There are also trade-offs to consider, such as refreshing the access token on page startup and ensuring that the refresh endpoint is protected against CSRF attacks if the frontend and API are on different domains.

In addition to refresh token rotation, there are three production issues that should not be ignored. First, network retries can cause confusion if the server rotates a token but the response does not reach the client. Second, parallel browser tabs may attempt to refresh tokens simultaneously, so coordination on the client and server is necessary.

Finally, sessions that never expire should be avoided, as each token family should have an absolute expiration time that cannot be extended through rotation. Active token families should be revoked when a user changes their password or logs out.

In summary, while refresh token rotation helps detect and respond to stolen refresh tokens, it is not a foolproof solution. Strong authentication design requires making token consumption atomic, ensuring revocation is effective, and handling retries without weakening security. Short-lived access tokens combined with refresh token rotation provide a stronger authentication mechanism.