JWT Token Rotation and Reuse Detection

Let's consider the user authentication system as a base to explain the token rotation and reuse detection feature.

What happens on a successful login?

On successful login, both access and refresh tokens are generated

Access Token: Last for a very short period

Refresh Token: Last for a long time

Flow of JWT

• Access Token is sent as JSON data and the client stores that in the memory and not in the local storage or cookie

• Refresh Token is sent as an httpOnly cookie and is not accessible via Javascript and must have expiry at some point

• Every time the API is accessed the access token is sent with every API request and the client uses it for API Access until it expires

• New Token is issued at every refresh request after the access token is expired and refresh tokens are used to get the new access token

• Refresh Token is verified with its end-point and compared to data in the database

• Refresh Token must be removed or allowed to expire during Logout

But but but...what if - Refresh Token is comprised

Refresh Token is comprised and malicious access is granted until the refresh token expires

To reduce this risk, we cannot say to eliminate but to reduce this risk there comes into picture the token rotation and reuse detection feature

Token Rotation

Token rotation is the process of periodically issuing new tokens to replace the existing ones. This can be done in several ways, depending on the requirements of the application. Some of the most common ways to rotate tokens include:

1. Time-based rotation: In this method, tokens are automatically rotated after a certain period. For example, a token may be valid for 24 hours and then automatically replaced with a new one. This approach is simple to implement, but it requires the client to keep track of the token expiration time and refresh the token before it expires.

2. Usage-based rotation: In this method, tokens are rotated based on how often they are used. For example, a token may be valid for 100 requests and then automatically replaced with a new one. This approach is more secure than time-based rotation, as it limits the amount of time a compromised token can be used.

3. Event-based rotation: In this method, tokens are rotated based on specific events. For example, a token may be rotated when a user's password is changed, or when an administrator revokes a user's access. This approach is the most secure, as it allows for immediate revocation of access in case of a security incident.

Token Reuse Detection

Token reuse detection is a security mechanism that is used to detect and prevent the reuse of a previously issued token. This is important because if an attacker obtains a valid token, they can use it to gain unauthorized access to protected resources unless the token is detected and invalidated.

There are several ways to detect token reuse, some of the most common ones include:

1. Token blacklists: This method involves maintaining a list of all issued tokens that have been revoked or expired. Any incoming request with a token that is found in the blacklist will be rejected.

2. Token binding: This method involves binding a token to a specific device, or user agent. Any incoming request with a token that is not bound to the correct device or user agent will be rejected.

3. Token revocation: This method involves providing a mechanism for revoking tokens so that they can no longer be used. This can be done by adding a unique identifier to each token and then maintaining a list of revoked identifiers.

4. Token usage tracking: This method involve keeping track of how many times a token has been used and if it exceeds a certain limit, it will be considered as compromised and invalidated.

That's a wrap I hope you got an idea of how token rotation and reuse detection features are important in the case of JWT Authentication