What if the refresh token is compromised about node-jsonwebtoken HOT 2 OPEN

It works like this

• User logs in and is issued an access token and refresh token
• Something is changed in their account, potentially revoking access to some part of the system
• The users access token continues to be valid until it expires, they can potentially still access the revoked part of the system (unless the backend is validating on each request).
• The users access token expires and they refresh with the refresh token.
• The new access token has the change to their authorization, potentially denying them all access.

So in effect the expiry time of the access token is the maximum time authorization may be granted to the user. The refresh token defined how long can be elapsed before they have to refresh or login again, at which point a server check is done to issue, or deny to issue, an access token with the appropriate claims.

from node-jsonwebtoken.

Guess due to the nature of JWT - stateless, it's necessary to leverage some stateful mechanism on server side to remedy this, say, block list, token version, session, etc..

from node-jsonwebtoken.