JWT authentication design
Design a secure JWT access + refresh token flow for a .NET API.
Answers use simple, clear English.
Quick interview answer
Issue short-lived access JWTs (5–15 min) and long-lived refresh tokens stored hashed server-side (or rotating refresh tokens). Validate issuer, audience, lifetime, and signing key. Use HTTPS only, store refresh tokens in HttpOnly Secure cookies for SPAs when possible, rotate refresh tokens on use, and revoke on logout/compromise.
Detailed answer
Issue short-lived access JWTs (5–15 min) and long-lived refresh tokens stored hashed server-side (or rotating refresh tokens). Validate issuer, audience, lifetime, and signing key. Use HTTPS only, store refresh tokens in HttpOnly Secure cookies for SPAs when possible, rotate refresh tokens on use, and revoke on logout/compromise.
Common mistakes
Long-lived access tokens; storing JWTs in localStorage without XSS controls; no refresh rotation.
Best practices
Prefer OAuth2/OIDC with IdentityServer, Auth0, or Entra ID for production identity.
Follow-up questions
- Where should refresh tokens be stored for mobile vs SPA?
- How do you handle key rotation (JWKS)?