6 min read
2026-01-21
Payload is only Base64 encoded, but not encrypted. Anyone can read its contents.
The recommended lifetime of an access token is 15–30 minutes. For long sessions, use refresh tokens.
Always check the signature, expiration date, and issuer of the token on the server side.
RS256 is more secure than HS256 in a microservice architecture, since the private key is stored in only one service.
Always explicitly indicate acceptable algorithms during verification.
HttpOnly cookie - XSS protection
Don't use localStorage for sensitive tokens
Add CSRF protection when using cookies
Maintain a blacklist of revoked tokens or use a short TTL with rotation.
Log the creation and use of tokens to detect suspicious activity.
See also: HTTP status codes, JSON Formatter, MIME Types