SRS-090 Generated JWTs must have an expiration date.
Identifier
SRS-090
Software System
- Authentication Service
Category
- Security
Description
To limit the window of opportunity for session hijacking, all JSON Web Tokens (JWTs) issued by the system shall include a mandatory expiration claim (exp).
This is a critical security measure because a token without an expiration date, if compromised, could grant an attacker indefinite access to a user's account. By enforcing a finite lifetime, the token automatically becomes invalid after a set period, forcing re-authentication and ensuring that stolen tokens have a limited use. The system shall validate this claim upon every request and reject any token that is expired. The token's lifespan shall be configurable by an administrator.
Derived from PRS
PRS-9F2: Cybersecurity & continuous threat detection