JWT Token Rotation and Reuse Detection
Most of you are aware of JWT (JSON web token) Authentication but do you know about token rotation and reuse detection? If not, let's dive into it
3 min read
Photo by Roman Synkevych 🇺🇦 on Unsplash
Let's consider the user authentication system as a base to explain the token rotation and reuse detection feature.
What happens on a successful login?
On successful login, both access and refresh tokens are generated
Access Token: Last for a very short period
Refresh Token: Last for a long time
Flow of JWT
Access Token is sent as JSON data and the client stores that in the memory and not in the local storage or cookie
Every time the API is accessed the access token is sent with every API request and the client uses it for API Access until it expires
New Token is issued at every refresh request after the access token is expired and refresh tokens are used to get the new access token
Refresh Token is verified with its end-point and compared to data in the database
Refresh Token must be removed or allowed to expire during Logout
But but but...what if - Refresh Token is comprised
Refresh Token is comprised and malicious access is granted until the refresh token expires
To reduce this risk, we cannot say to eliminate but to reduce this risk there comes into picture the token rotation and reuse detection feature
Token rotation is the process of periodically issuing new tokens to replace the existing ones. This can be done in several ways, depending on the requirements of the application. Some of the most common ways to rotate tokens include:
Time-based rotation: In this method, tokens are automatically rotated after a certain period. For example, a token may be valid for 24 hours and then automatically replaced with a new one. This approach is simple to implement, but it requires the client to keep track of the token expiration time and refresh the token before it expires.
Usage-based rotation: In this method, tokens are rotated based on how often they are used. For example, a token may be valid for 100 requests and then automatically replaced with a new one. This approach is more secure than time-based rotation, as it limits the amount of time a compromised token can be used.
Event-based rotation: In this method, tokens are rotated based on specific events. For example, a token may be rotated when a user's password is changed, or when an administrator revokes a user's access. This approach is the most secure, as it allows for immediate revocation of access in case of a security incident.
Token Reuse Detection
Token reuse detection is a security mechanism that is used to detect and prevent the reuse of a previously issued token. This is important because if an attacker obtains a valid token, they can use it to gain unauthorized access to protected resources unless the token is detected and invalidated.
There are several ways to detect token reuse, some of the most common ones include:
Token blacklists: This method involves maintaining a list of all issued tokens that have been revoked or expired. Any incoming request with a token that is found in the blacklist will be rejected.
Token binding: This method involves binding a token to a specific device, or user agent. Any incoming request with a token that is not bound to the correct device or user agent will be rejected.
Token revocation: This method involves providing a mechanism for revoking tokens so that they can no longer be used. This can be done by adding a unique identifier to each token and then maintaining a list of revoked identifiers.
Token usage tracking: This method involve keeping track of how many times a token has been used and if it exceeds a certain limit, it will be considered as compromised and invalidated.
That's a wrap I hope you got an idea of how token rotation and reuse detection features are important in the case of JWT Authentication