JWT tokens have a reasonable expiry if used

JWTs are stateless — they cannot be individually revoked before their expiry timestamp. A token with a 365-day lifetime handed to a compromised client, leaked via a log line, or obtained through an XSS payload is valid for a year with no mechanism to invalidate it. CWE-613 (Insufficient Session Expiration) and CWE-347 (Improper Verification of Cryptographic Signature) are both relevant when tokens are issued without meaningful expiry. NIST 800-63B §7.1 requires that session credentials be time-bounded. OWASP A02 covers cryptographic failure modes that include issuing tokens with no or excessive expiry.

Set short access token expiry and pair it with rotating refresh tokens rather than issuing long-lived access tokens:

import { SignJWT } from 'jose'

// Access token: 15 minutes
const accessToken = await new SignJWT({ sub: userId, role: user.role })
  .setProtectedHeader({ alg: 'HS256' })
  .setIssuedAt()
  .setExpirationTime('15m')
  .sign(secret)

// Refresh token: 7 days, rotate on each use
const refreshToken = await new SignJWT({ sub: userId, type: 'refresh' })
  .setProtectedHeader({ alg: 'HS256' })
  .setIssuedAt()
  .setExpirationTime('7d')
  .sign(secret)

For API tokens issued to users (not internal session tokens), store a hash server-side and allow revocation via a token management interface. Never issue tokens with expiresIn: '100y' or no expiry.