1. Stateless Authentication in Distributed Systems
Traditional stateful session cookies stored in server memory (or centralized Redis instances) introduce synchronization bottlenecks when scaling REST microservices horizontally across multiple availability zones. JSON Web Tokens (JWT) provide a stateless alternative by encapsulating user identity, roles, and cryptographic signatures directly within client-held headers.
2. The Danger of Long-Lived Access Tokens
Because JWTs are self-contained and verified locally using the server public key or HMAC secret without database lookups, revoking a compromised token before its expiration is difficult. Issuing access tokens valid for days or weeks creates a severe security window if an attacker intercepts the token.
3. Dual-Token Architecture: Access and Refresh Tokens
The industry benchmark combines short-lived Access Tokens (valid for 5 to 15 minutes) with long-lived Refresh Tokens (valid for 7 to 30 days): access tokens are kept in memory and passed via the Authorization: Bearer header, while refresh tokens are stored in secure, HttpOnly, SameSite=Strict cookies inaccessible to JavaScript XSS.
4. Implementing Sliding Expiration and Token Rotation
When the short-lived access token expires, the client calls a /refresh endpoint. The server validates the refresh token against a single database table, issues a brand-new access token, and invalidates the old refresh token (Refresh Token Rotation). If a previously used refresh token is presented, the server immediately flags a security breach and invalidates all active sessions for that user account.
%20and%20Sliding%20Expiration){kind=link}