Specialized audit of token lifecycle, including expiration, refresh rotation, and session synchronization.
Identify the token management components.
Evaluate the renewal mechanism.
alg: none attack mitigated? Are we forcing a secure algorithm (HS256/RS256)?HttpOnly cookie or exposed to JS in localStorage?auth-security-audit).backend-code-review).Security vs UX balance assessment.
Specific risks like "RT reuse possible" or "LocalStorage exposure".
Table of current vs recommended durations.
| Item | Current Value | Recommendation | Rationale |
|---|---|---|---|
| AT Expiry | ... | ... | ... |
| RT Expiry | ... | ... | ... |
Code snippets to improve the refresh-rotation flow or cookie headers.