Spring Boot JWT auth needs

Short summary

Production JWT auth in Spring Boot requires refresh token rotation in HttpOnly cookies, revocation tracking, and replay-attack detection via the OAuth 2.0 token family pattern—security gaps most tutorials ignore.

• •Separate access tokens (15 min, in-memory) from refresh tokens (7 days, HttpOnly cookie)
• •Implement refresh token rotation and revocation to detect token reuse attacks
• •Use the OAuth 2.0 token family pattern: if old token is reused, revoke all tokens for that user

Generated with AI, which can make mistakes.