Loading
Topic
JWT validation, token lifetime, refresh rotation, revocation, token storage, reset tokens, and claim freshness.
Practice items tagged with Token Security.
Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.
Explains when CSRF matters, how cookies change browser behavior, and what mitigations fit API clients.
Explains reset-token generation, hashing, expiration, generic responses, session revocation, and abuse controls.
Explains logout semantics for token-based APIs, revoking refresh tokens, device/session records, and short-lived access-token limits.
Explains what happens when roles or tenant membership change while access tokens still contain old claims.
Separates OAuth authorization from OpenID Connect authentication and explains why modern interactive clients use authorization code with PKCE.