JWT Without Expiration

Detects JWTs issued without expiration claims, creating tokens that remain valid indefinitely.

zakirkun Updated

File contents

JWT Without Expiration

Overview

JWTs without expiration (exp claim) or with very long expiration never become invalid unless the secret is rotated. This means:

  • Stolen tokens remain valid forever
  • Deprovisioned users can still authenticate
  • No way to force re-authentication without key rotation

Remediation

  • Set short-lived access tokens: 15 minutes to 1 hour
  • Use refresh tokens with longer validity for user experience
  • Implement token revocation list for immediate invalidation

zakirkun/ice-tea/tree/main/skills/api/jwt-expiry-missing commit 480cec682a

Frequently asked questions

npx skillmds@latest add zakirkun/jwt-without-expiration