SRS-090 Generated JWTs must have an expiration date.
Identifier​
SRS-090
Software System​
- Authentication Service
Category​
- Security
Description​
To limit the window of opportunity for session hijacking, all JSON Web Tokens (JWTs) issued by the system shall include a mandatory expiration claim (exp).
This is a critical security measure because a token without an expiration date, if compromised, could grant an attacker indefinite access to a user's account. By enforcing a finite lifetime, the token automatically becomes invalid after a set period, forcing re-authentication and ensuring that stolen tokens have a limited use. The system shall validate this claim upon every request and reject any token that is expired. The token's lifespan shall be configurable by an administrator.
Derived from PRS​
PRS-9F2: Cybersecurity & continuous threat detection