What if the refresh token is compromised
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 15/100
- Issue type
- Documentation
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- node.js
- Domain
- authentication, security
Research direction
The issue names no files, tests, or code entry points; it asks for a conceptual explanation of compromised JWT refresh tokens. Start by reviewing the project's JWT usage and relevant authentication guidance, then document a clear answer describing what should happen when a refresh token is stolen.
Written by the indexing model from the issue text.
Description
As far as I understand a JWT token has two parts
- access token (short validity)
- refresh token (long validity)
The purpose of keeping the access token short lived is if it gets compromised, the user will not be access the resource after its expiry.
The purpose of keeping the refresh token long lived is if the access token gets expired, the refresh token can then be used to generate a new access token OR increase the expiry time of the access token.
My question is, what if the refresh token gets compromised? In that case what is the whole point of keeping the access token short lived? Because the hacker can then keep reissuing a new access token each time it gets expired using the stolen refresh token.
Can someone explain to me please?
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
mksglu/context-mode#1200 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
neondatabase/website#5944 ·
-
module: core
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
bigbluebutton/bigbluebutton#25849 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
jaegertracing/jaeger-ui#4506 ·