[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571921-105":53,"doc-detail-571921-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","authentication-and-session-management-in-modern-web-applications-using-jwt-with-rotating-refresh-tokens","Authentication and session management in modern web applications using JWT with rotating refresh tokens","","The exponential growth of single-page applications, progressive web apps, and decoupled API-driven platforms makes stateless authentication a core architectural issue. Traditional server-side session management limits horizontal scaling, while JWT-based stateless verification introduces risks such as token theft via XSS and the absence of native revocation. The study proposes defense-in-depth using short-lived access tokens and rotating refresh tokens stored as cryptographic hashes in a relational database. Refresh rotation invalidates prior tokens, reducing reuse of stolen credentials, while HttpOnly cookies with SameSite=Lax mitigate script exfiltration and CSRF without dedicated CSRF tokens.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/authentication-and-session-management-in-modern-web-applications-using-jwt-with-rotating-refresh-tokens/571921/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/authentication-and-session-management-in-modern-web-applications-using-jwt-with-rotating-refresh-tokens/571921.png","ImageObject",442,249,{"name":88,"@type":89},"Fans","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-21","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",6,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"Why does stateless authentication become a fundamental concern in modern web applications?","Question",{"text":109,"@type":110},"Modern architectures emphasize decoupled frontends and scalable backends, making traditional server-side session tables harder to operate across distributed instances. Stateless authentication better matches horizontal scaling needs in cloud-native deployments.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"What security problems does JWT introduce despite enabling stateless verification?",{"text":114,"@type":110},"JWT can create a larger attack window when tokens are valid for long periods, since stolen tokens enable impersonation until expiration. Revoking individual tokens also becomes difficult without introducing token revocation state.",{"name":116,"@type":107,"acceptedAnswer":117},"How does rotating refresh tokens improve security and usability in the proposed approach?",{"text":118,"@type":110},"Each successful refresh invalidates the prior refresh token and issues a new token pair, preventing long-term reuse of stolen credentials. Combined with short-lived access tokens and HttpOnly cookies using SameSite=Lax, the approach narrows the compromised token lifetime while reducing operational complexity.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},571921,1792338323,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":20,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":47},5909892330395,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","Authentication and session management in modern web applications using JWT with rotating refresh tokens  \nIgor Andrushchak  \nLutsk National Technical University, Lutsk, Ukraine ORCID: 0000-0002-8751-4420  \nBohdan Kupyra  \nLutsk National Technical University, Lutsk, Ukraine ORCID: 0009-0007-4395-3337  \nAbstract: The exponential growth of single-page applications, progressive web applications, and decoupled API-driven web platforms has made stateless authentication a fundamental architectural concern. Traditional server-side session management, while well-understood and secure, imposes scaling constraints that are increasingly incompatible with the horizontal scaling requirements of modern cloud-native deployments. JSON Web Tokens have emerged as the dominant alternative, offering stateless verification and cross-domain support, but introducing distinct security challenges: token theft via cross-site scripting, lack of native revocation, and the fundamental tension between token lifetime and user convenience. This research examines a defense-in-depth authentication architecture combining short-lived access tokens with rotating refresh tokens stored as cryptographic hashes in a relational database. The proposed model addresses the trade-off between security and usability by maintaining sessions of practical duration while limiting the attack window of any single compromised access token to a maximum of fifteen minutes. Refresh token rotation, in which each successful refresh invalidates the prior token and issues a new pair, prevents long-term reuse of stolen credentials. Storage of tokens in [httpOnly cookies with the](httpOnly cookies with the) SameSite=Lax attribute protects against the two primary client-side attack vectors—script-based exfiltration and cross-site request forgery—without imposing the operational complexity of dedicated CSRF tokens. The authentication subsystem was implemented and validated in a production-grade e-commerce platform built on Next.js 16 and NestJS 11 with the Prisma ORM over a SQLite backend, comprising 59 REST endpoints and 20 database models. Empirical measurement confirms that the architecture sustains authentication latency below 250 milliseconds for login operations and below 50 milliseconds for token refresh operations under typical load. The research evaluates seven layered security mechanisms aligned with OWASPASVS Level 1, including bcrypt password hashing with cost factor 12, rate limiting on authentication endpoints, and content security policy headers. Results demonstrate that the proposed architecture provides a defensible balance between security guarantees and operational simplicity, applicable to small-to-medium e-commerce systems, microservice architectures, and resource-constrained deployments.  \nKeywords: authentication; session management; JSON Web Token; refresh token rotation; OWASP ASVS; [httpOnly cookies](httpOnly cookies) ; web application security; bcrypt; NestJS; full-stack TypeScript  \n1. Introduction  \nThe architectural shift from server-rendered monoliths to decoupled web applications has fundamentally changed how user identity is established and maintained across requests. In the traditional model, a server maintained an in-memory or database-backed session table indexed by an opaque session identifier transmitted to the client through a browser cookie. Every authenticated request triggered a server-side lookup that confirmed the validity of the session and retrieved the associated user record. This pattern, although operationally well understood and supported by virtually every web framework of the past two decades, has reached the limits of its applicability in  \ndistributed systems where requests can be served by any of several stateless application instances behind a load balancer.  \nModern web applications increasingly follow a separation between presentation and data, in which the user interface is delivered as a JavaScript bundle from a content delivery netw","cbCainG9jrRJC5mD","https://ap.wps.com/l/cbCainG9jrRJC5mD","pdf",421285,"English","# 1. Introduction\n# JSON Web Tokens (JWT) and stateless authentication challenges\n## Limits of server-side sessions in distributed systems\n## Practical security difficulties with long-lived JWTs","[{\"question\":\"Why does stateless authentication become a fundamental concern in modern web applications?\",\"answer\":\"Modern architectures emphasize decoupled frontends and scalable backends, making traditional server-side session tables harder to operate across distributed instances. Stateless authentication better matches horizontal scaling needs in cloud-native deployments.\"},{\"question\":\"What security problems does JWT introduce despite enabling stateless verification?\",\"answer\":\"JWT can create a larger attack window when tokens are valid for long periods, since stolen tokens enable impersonation until expiration. Revoking individual tokens also becomes difficult without introducing token revocation state.\"},{\"question\":\"How does rotating refresh tokens improve security and usability in the proposed approach?\",\"answer\":\"Each successful refresh invalidates the prior refresh token and issues a new token pair, preventing long-term reuse of stolen credentials. Combined with short-lived access tokens and HttpOnly cookies using SameSite=Lax, the approach narrows the compromised token lifetime while reducing operational complexity.\"}]","Authentication and session management in modern web applications using JWT with rotating refresh tokens | PDF",1791924459]