[{"data":1,"prerenderedAt":280},["ShallowReactive",2],{"navigation":3,"\u002Fblog\u002Funderstand-refresh-token":46,"\u002Fblog\u002Funderstand-refresh-token-surround":275},[4],{"title":5,"path":6,"stem":7,"children":8,"page":45},"Blog","\u002Fblog","blog",[9,13,17,21,25,29,33,37,41],{"title":10,"path":11,"stem":12},"Audio Augmentation Techniques for Deep Learning","\u002Fblog\u002Faudio-augmentation","blog\u002Faudio-augmentation",{"title":14,"path":15,"stem":16},"Speed Up Whisper with CTranslate2","\u002Fblog\u002Fc-translate","blog\u002Fc-translate",{"title":18,"path":19,"stem":20},"Calling C++ and Go from Dart using FFI","\u002Fblog\u002Fdart-ffi-native-bridge","blog\u002Fdart-ffi-native-bridge",{"title":22,"path":23,"stem":24},"Russey Keo High School Memories","\u002Fblog\u002Fmemory","blog\u002Fmemory",{"title":26,"path":27,"stem":28},"My Dev Setup: Same Keys Everywhere","\u002Fblog\u002Fmy-dev-setup","blog\u002Fmy-dev-setup",{"title":30,"path":31,"stem":32},"Data Extraction with LangChain and Ollama Locally","\u002Fblog\u002Fpydantic-llm","blog\u002Fpydantic-llm",{"title":34,"path":35,"stem":36},"7-Segment LED Display with Proteus Simulation","\u002Fblog\u002Fseven-segment","blog\u002Fseven-segment",{"title":38,"path":39,"stem":40},"Understanding JWT Refresh Token Rotation & Revocation","\u002Fblog\u002Funderstand-refresh-token","blog\u002Funderstand-refresh-token",{"title":42,"path":43,"stem":44},"Khmer Speech Recognition","\u002Fblog\u002Fwhisper","blog\u002Fwhisper",false,{"id":47,"title":38,"author":48,"body":52,"date":264,"description":265,"extension":266,"image":267,"meta":268,"minRead":256,"navigation":272,"path":39,"seo":273,"stem":40,"__hash__":274},"blog\u002Fblog\u002Funderstand-refresh-token.md",{"name":49,"avatar":50},"Phanith LIM",{"src":51,"alt":49},"\u002Fmyprofile.jpg",{"type":53,"value":54,"toc":254},"minimark",[55,64,67,72,75,98,101,105,108,123,126,130,133,203,209,229,233,244,247,251],[56,57,58,59,63],"p",{},"If you rotate refresh tokens, every refresh hands back a new access token ",[60,61,62],"em",{},"and"," a new refresh token. So why set the refresh token to 7 days? If it gets replaced anyway, why not 30 minutes?",[56,65,66],{},"Because the expiry is not about how long the token lives. It is about how long a user can be away.",[68,69,71],"h3",{"id":70},"a-30-minute-token-breaks-lunch","A 30-minute token breaks lunch",[56,73,74],{},"Say you set the refresh token to 30 minutes, for extra security.",[76,77,78,86,92],"ol",{},[79,80,81,85],"li",{},[82,83,84],"strong",{},"12:00",": the user logs in. Access token: 15 minutes. Refresh token: 30 minutes.",[79,87,88,91],{},[82,89,90],{},"12:15",": they finish what they were doing and close the laptop to get lunch.",[79,93,94,97],{},[82,95,96],{},"12:50",": they come back and open the app.",[56,99,100],{},"Both tokens are dead. The access token expired at 12:15, the refresh token at 12:30. The user has to type their password again because they stepped away for 35 minutes, and they blame your app for it.",[68,102,104],{"id":103},"_7-days-is-a-sliding-window","7 days is a sliding window",[56,106,107],{},"With a 7-day refresh token you get a window that keeps moving:",[109,110,111,117],"ul",{},[79,112,113,116],{},[82,114,115],{},"Active user:"," every refresh resets the 7-day timer. As long as they keep using the app, they stay logged in.",[79,118,119,122],{},[82,120,121],{},"User on holiday:"," no app for 10 days, the timer runs out, and they log in again when they return.",[56,124,125],{},"That is the real setting you are choosing: how long inactivity is allowed before a password is required.",[68,127,129],{"id":128},"expiry-is-the-clock-revocation-is-the-kill-switch","Expiry is the clock, revocation is the kill switch",[56,131,132],{},"Expiry is a token dying of old age. Revocation is you killing it on purpose.",[134,135,136,153],"table",{},[137,138,139],"thead",{},[140,141,142,147,150],"tr",{},[143,144,146],"th",{"align":145},"left","Feature",[143,148,149],{"align":145},"Expiration",[143,151,152],{"align":145},"Revocation",[154,155,156,170,183],"tbody",{},[140,157,158,164,167],{},[159,160,161],"td",{"align":145},[82,162,163],{},"Controlled by",[159,165,166],{"align":145},"The clock",[159,168,169],{"align":145},"The admin \u002F server",[140,171,172,177,180],{},[159,173,174],{"align":145},[82,175,176],{},"Question",[159,178,179],{"align":145},"\"Is this token too old?\"",[159,181,182],{"align":145},"\"Is this token still allowed?\"",[140,184,185,190,197],{},[159,186,187],{"align":145},[82,188,189],{},"Database",[159,191,192,193],{"align":145},"Checked via ",[194,195,196],"code",{},"expiry_date",[159,198,192,199,202],{"align":145},[194,200,201],{},"is_revoked"," column",[56,204,205,206,208],{},"That ",[194,207,201],{}," column earns its place three times over:",[109,210,211,217,223],{},[79,212,213,216],{},[82,214,215],{},"Logout."," The server marks the token revoked, so it can never be used again.",[79,218,219,222],{},[82,220,221],{},"Password reset."," Revoke every token for that user and all their sessions drop at once.",[79,224,225,228],{},[82,226,227],{},"Stolen token."," If someone replays an old rotated token, the server sees it is already revoked and can lock the account.",[68,230,232],{"id":231},"rotation-step-by-step","Rotation, step by step",[76,234,235,238,241],{},[79,236,237],{},"The client logs in with a username and password. The server stores refresh token 1 with a 7-day expiry and returns access token 1 and refresh token 1.",[79,239,240],{},"Access token 1 expires. The client asks for a refresh and sends refresh token 1.",[79,242,243],{},"The server checks that refresh token 1 is valid and not revoked, marks it revoked, stores a new refresh token 2 with a fresh 7-day window, and returns access token 2 and refresh token 2.",[56,245,246],{},"Step 3 is the whole trick. The old token is revoked the moment it is used, so any later attempt to reuse it is both rejected and a signal that something is wrong.",[68,248,250],{"id":249},"in-short","In short",[56,252,253],{},"The 7-day expiry is your inactivity limit: it keeps active users logged in. Rotation and revocation are what make a long-lived session safe to hand out.",{"title":255,"searchDepth":256,"depth":256,"links":257},"",2,[258,260,261,262,263],{"id":70,"depth":259,"text":71},3,{"id":103,"depth":259,"text":104},{"id":128,"depth":259,"text":129},{"id":231,"depth":259,"text":232},{"id":249,"depth":259,"text":250},"2026-01-21","Why a refresh token lives for 7 days, and what the revoke column is for.","md","\u002Fblog\u002Funderstand-refresh-token\u002Fcover.jpg",{"tags":269},[270,271],"Security","Authentication",true,{"title":38,"description":265},"F_pD6V8k8F6n66V8xTQzFATiIVrA5DSsQTzSej3E8pQ",[276,278],{"title":34,"path":35,"stem":36,"description":277,"children":-1},"Turning four input bits into ten digits with K-maps, then simulating the circuit in Proteus.",{"title":42,"path":43,"stem":44,"description":279,"children":-1},"Fine-tuning Whisper for Khmer, and why the data was the hard part.",1791981008543]