Authentication tokens have a defined expiration time

Non-expiring tokens are stolen credentials that never go stale. If a JWT or session cookie is intercepted via XSS, a compromised device, or a logging system that captures auth headers, an attacker holds permanent access until the user explicitly rotates it — which most users never do. OWASP API2 (Broken Authentication) and CWE-613 (Insufficient Session Expiration) both flag long-lived tokens as a direct enabler of account takeover. Access tokens should be short-lived (15 min to 1 hour); refresh tokens can be longer but must rotate. Compliance frameworks including SOC 2 and PCI DSS require session timeout controls.

Set an expiresIn value on every JWT you sign and reject expired tokens in middleware. Access tokens should expire within 1 hour; pair them with short-lived refresh tokens for seamless renewal.

// src/lib/tokens.ts
export function signAccessToken(userId: string) {
  return jwt.sign(
    { sub: userId, type: 'access' },
    process.env.JWT_SECRET!,
    { expiresIn: '1h' }  // never omit this
  )
}

export function verifyAccessToken(token: string) {
  // jwt.verify throws TokenExpiredError automatically — no manual exp check needed
  return jwt.verify(token, process.env.JWT_SECRET!) as { sub: string }
}

For cookies, set maxAge (not just expires) so the browser enforces expiry even when the tab stays open.