Detecting session hijacking using rotating refresh tokens in web applications
summary
Claims that rotating refresh tokens let the backend detect stolen sessions by issuing one-time refresh tokens and flagging reuse, and that combining very short-lived access tokens with IP checks or tls-binding (where supported) reduces attacker window. Describes a workable implementation: a refresh token family tree to avoid false positives from parallel requests and poor networks, notes scalability challenges in distributed stores, and reports business wins: longer safe logins, RFC alignment, and sub-millisecond JWT verification.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 2:49Detecting session hijacking
- 3:56Using rotating refresh tokens
- 5:19Demo
- 9:11Implementation
- 12:42Business benefits
related talks
26mApplying Proper Security Practices With JWT
38mAuthentication as a Microservice: Portable Customer Identity Management
26mSecuring Single Page Applications with Token Based Authentication
32mPortable Sessions with JSON Web Tokens
29mToken Security in Single Page Applications
15mJWTs And Why They Suck
57mThe insecurity of OAuth 2.0 in frontends
23mPrevent Catastrophe When Authentication Goes Wrong