JWT Expiry and Token Refresh – Java Backend Interview

Direct Answer

The resource server rejects an access token after its exp time. A client may then use a separately protected refresh token at the authorization server to obtain a new access token, but it should not refresh blindly for every 401. Access and refresh lifetimes are chosen from risk and user experience rather than fixed numbers. For higher-risk clients, rotate refresh tokens, store each active token or family server-side, and detect reuse so a replay can revoke the affected family.

Code Example

@Transactional
public TokenPair rotate(String presentedValue) {
    RefreshToken current = repository.findForUpdate(hash(presentedValue))
        .orElseThrow(InvalidGrantException::new);

    if (current.isExpired() || current.isRevoked()) {
        repository.revokeFamily(current.familyId());
        throw new InvalidGrantException();
    }

    current.revoke();
    RefreshToken replacement = RefreshToken.nextInFamily(current.familyId());
    repository.save(replacement);
    return new TokenPair(issueAccessToken(current.subject()), replacement.plainValueOnce());
}

Store a one-way hash of the refresh token where possible, rotate inside one transaction, and define how reuse of an old family member is detected and handled.

Common Mistakes & Pitfalls

• Setting 7-day expiry on access tokens: Freshers avoid refresh logic by making access tokens live for days. This defeats the purpose — a stolen token is valid for a week. Access tokens should be short (15-60 min) so compromised tokens expire quickly.
• Storing refresh tokens in localStorage: Browser localStorage is vulnerable to XSS attacks. Store refresh tokens in httpOnly secure cookies or in-memory variables for SPAs. If using cookies, set SameSite=Strict to prevent CSRF.
• Not invalidating refresh tokens on logout: Freshers forget to delete refresh tokens from the database on logout. If a user logs out, their refresh token should be immediately revoked so no one can use it to mint new access tokens.
• Allowing unlimited refresh token reuse: Without rotation, a leaked refresh token can be used indefinitely until it expires. Each refresh should invalidate the old token and issue a new one.