JWT Without Expiration

Detects JWTs issued without expiration claims, creating tokens that remain valid indefinitely.

zakirkun 480cec6 2 files · 2.2 KB Updated

File contents

JWT Without Expiration

Overview

JWTs without expiration (exp claim) or with very long expiration never become invalid unless the secret is rotated. This means:

  • Stolen tokens remain valid forever
  • Deprovisioned users can still authenticate
  • No way to force re-authentication without key rotation

Remediation

  • Set short-lived access tokens: 15 minutes to 1 hour
  • Use refresh tokens with longer validity for user experience
  • Implement token revocation list for immediate invalidation

zakirkun/ice-tea/tree/main/skills/api/jwt-expiry-missing commit 480cec682a

Frequently asked questions

npx skillmds@latest add zakirkun/jwt-without-expiration