Applying Proper Security Practices With JWT
summary
Use JWTs as short-lived access tokens 15-minute access token plus longer refresh tokens 7-day refresh token. Generate a per-device UUID, include userID and UUID as token claims, and store that metadata in Redis (metadata (userID + uuid) in Redis) instead of a relational DB. Verify incoming access tokens by validating signature then checking the UUID exists in Redis; revoke by deleting the Redis entry so expired-but-present JWTs become useless (per-device revocation). Secrets come from env vars; code examples shown in Go with refresh flow that returns new token pairs.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:41Victor Steven
- 2:42Some Questions about JWT
- 3:40Bad Practices
- 7:26Applying JWT
- 20:13The Refresh Token Flow
related talks
14mDetecting session hijacking using rotating refresh tokens in web applications
32mTips and Tricks for JSON Web Tokens (JWTs)
19mJWTs Explained
37mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
38mAuthentication as a Microservice: Portable Customer Identity Management
45mJWT - To authentication & beyond!
32mPortable Sessions with JSON Web Tokens
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens