JWT Authentication Guide: Claims, Verification, Key Rotation, and Refresh Tokens

JWT Authentication Guide: Claims, Verification, Key Rotation, and Refresh Tokens

JWTs are compact tokens containing claims that can be cryptographically signed. In authentication systems, the difficult part is not creating a token—it is validating and rotating it correctly.

Verify More Than the Signature

A resource server should validate the token according to its exact contract:

signature
accepted algorithm
issuer (iss)
audience (aud)
expiration (exp)
not-before (nbf) when used

RFC 8725 specifically requires applications to control which algorithms are acceptable rather than trusting the token's alg header blindly.

Keep Access Tokens Short-Lived

Short-lived access tokens reduce the useful lifetime of a stolen bearer token.

For longer sessions, use a separate refresh-token/session mechanism rather than issuing access tokens that remain valid for weeks.

Refresh tokens should be stored and protected as high-value credentials and rotated/revoked according to the authentication architecture.

Use Key IDs and Rotation

With asymmetric signing, APIs can verify tokens with public keys while the authorization service protects the private signing key.

Use key IDs (kid) only to select among trusted configured keys. Do not let an attacker-controlled token redirect verification to an arbitrary key source.

During rotation, publish the new verification key before removing the old one so tokens already issued can remain valid until their intended expiry.

JWTs Are Not Encrypted by Default

A typical signed JWT (JWS) protects integrity, not confidentiality. Anyone holding it can usually decode its claims.

Do not put passwords, private secrets, or unnecessary sensitive information inside access tokens.

Revocation Is a Design Trade-Off

Self-contained JWTs can be verified without a database lookup, but that means revoking one token immediately can require extra state such as a denylist/status mechanism or very short token lifetimes.

If instant server-side revocation is central to the product, an opaque session/token model may be simpler.

Final Takeaway

Secure JWT authentication means strict verification, narrow claims, short-lived access tokens, safe refresh/session handling, controlled key rotation, and a deliberate revocation model. A JWT is only a token format—it does not design the authentication system for you.

References

• RFC 7519: JSON Web Token
• RFC 8725: JWT Best Current Practices
• OWASP JSON Web Token Cheat Sheet