JWT Insufficient Session Expiration

Severity: high
Slug: jwt-insufficient-session-expiration

A JWT token must expire after a period of time. Otherwise an adversary has higher chance of reusing an old token and get an unauthorised access. Furthermore care should be taken in setting the expiry for a refresh token. An adversary can exploit a refresh token to get persistence access.

Remediation

Implement an expiry time for the token. The shorter is the expiry, the lower is the likelihood of token abuse.
Ensure refresh token is not refreshed automatically. Only after a full authentication (e.g. using username, password and MFA) a new refresh token should be issues.