How to handle token refresh

[nivv]

It's my understanding that using the same token over and over opens up a window of attack, therefore the token should only be valid for a set amount of time.

It would be awesome if you could show an example of how to do that. Or am I overthinking things? Is it OK to have a token that expires after two weeks for example?

What are your thoughts?

[chenkie]

I'd recommend against token refreshing for single page apps in general. The problem is that if an attacker ever gets a hold of the refresh token, they can effectively stay logged in forever, or at least until you change your secret key.

The JWTs that Auth0 issues are valid for 10 hours by default. This is a good amount of time in my view. Sure your users will need to sign in every day, but keeping the validity period narrow like this helps security.

[guillaumevincent]

@chenkie normally refresh token is allowed during 1 week. So attacker can't refresh token "forever".
And a token should be refreshed only if he is still valid.