{
  "id": 15246912,
  "title": "Your JWT lasts 7 days. Here’s What Happens When Someone Steals It.",
  "url": "https://urgent.news/2026/10/17/your-jwt-lasts-7-days-heres-what-happens-when-someone-steals-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-17T17:48:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/piyushsingh_dev/your-jwt-lasts-7-days-heres-what-happens-when-someone-steals-it-1blp"
  },
  "original_language": "en",
  "account": "This article explores the issue of JWT token security and how it can be compromised when a hacker steals the token. After logging into an application, the Spring Boot API generates a JWT that remains valid for seven days. If someone manages to steal the token, the user changing their password immediately may not solve the problem, as the stolen JWT can still be valid until it expires.\n\nThe biggest drawback of stateless JWT authentication is that once a token is stolen, it can remain valid until it expires. To address this issue, refresh token rotation is recommended. This means that every successful refresh of the access token replaces the old refresh token with a new one. For example, if the attacker steals a refresh token, the server can revoke it and issue a new one, preventing the stolen token from being used again.\n\nHowever, refresh token rotation is not without its challenges. Refresh tokens should be stored as httpOnly, secure cookies that cannot be accessed by JavaScript, and the access token should be kept in memory rather than written to disk. There are also trade-offs to consider, such as refreshing the access token on page startup and ensuring that the refresh endpoint is protected against CSRF attacks if the frontend and API are on different domains.\n\nIn addition to refresh token rotation, there are three production issues that should not be ignored. First, network retries can cause confusion if the server rotates a token but the response does not reach the client. Second, parallel browser tabs may attempt to refresh tokens simultaneously, so coordination on the client and server is necessary. Finally, sessions that never expire should be avoided, as each token family should have an absolute expiration time that cannot be extended through rotation. Active token families should be revoked when a user changes their password or logs out.\n\nIn summary, while refresh token rotation helps detect and respond to stolen refresh tokens, it is not a foolproof solution. Strong authentication design requires making token consumption atomic, ensuring revocation is effective, and handling retries without weakening security. Short-lived access tokens combined with refresh token rotation provide a stronger authentication mechanism.",
  "summary": "This is the next piece in my Spring Security series, after how JWT authentication works, how OAuth2 login works, and how method-level security works. Those were about how a request gets in. This one is about how a user stays logged in without leaving the door open. Imagine a user logs into your application. Your Spring Boot API issues a JWT valid for seven days. Three days later, someone steals…",
  "key_points": [
    "JWT tokens expire after 7 days of validity",
    "Stolen tokens remain valid until expiration",
    "Refresh token rotation recommended to prevent misuse"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}