JWT Refresh Token Rotation in Node.js

1. The Problem: Long-Lived Tokens Are a Ticking Bomb

A JWT is self-contained and stateless, which is exactly why it is dangerous when it lives too long. Whoever holds a valid access token IS the user until it expires — there is no server-side session to kill. OWASP is blunt about this: keep lifetimes short, validate exp, iss and aud strictly, and never accept alg none.

The fix has three parts that work together: access tokens that expire in minutes, refresh tokens that live longer but rotate on every use, and storage that keeps long-lived credentials out of JavaScript reach. Let’s build exactly that.

2. The Minimum Concepts: Access, Refresh, Rotation

Before touching code, you need four ideas clear. They are simple, but getting any of them wrong voids the whole design.

3. Step-by-Step Tutorial: Rotation in Node.js

We’ll use jsonwebtoken (v9, the Auth0-maintained library with jwt.sign and jwt.verify) on Express. The same pattern ports to jose — I show the equivalent at the end.

npm install express jsonwebtoken cookie-parser

import express from "express";
import jwt from "jsonwebtoken";
import cookieParser from "cookie-parser";
import crypto from "crypto";

const app = express();
app.use(express.json());
app.use(cookieParser());

const accessToken = jwt.sign(
  { sub: user.id, role: user.role },
  process.env.ACCESS_TOKEN_SECRET,
  { expiresIn: "15m", audience: "fintech-api", issuer: "my-fintech" }
);

const tokenId = crypto.randomUUID();
sessions.set(tokenId, { userId: user.id });

const refreshToken = jwt.sign(
  { sub: user.id },
  process.env.REFRESH_TOKEN_SECRET,
  { expiresIn: "7d", audience: "fintech-api", issuer: "my-fintech", jwtid: tokenId }
);

res.cookie("refreshToken", refreshToken, {
  httpOnly: true,
  secure: true,
  sameSite: "strict",
  path: "/auth/refresh",
  maxAge: 7 * 24 * 60 * 60 * 1000
});
res.json({ accessToken });

function requireAuth(req, res, next) {
  const header = req.headers.authorization || "";
  const token = header.replace("Bearer ", "");
  try {
    req.user = jwt.verify(token, process.env.ACCESS_TOKEN_SECRET, {
      algorithms: ["HS256"],
      audience: "fintech-api",
      issuer: "my-fintech"
    });
    return next();
  } catch (err) {
    return res.status(401).json({ message: "Invalid or expired token" });
  }
}

app.get("/api/balance", requireAuth, (req, res) => {
  res.json({ balance: getBalance(req.user.sub) });
});

app.post("/auth/refresh", (req, res) => {
  const oldToken = req.cookies.refreshToken;
  if (!oldToken) return res.status(401).json({ message: "Missing token" });
  let payload;
  try {
    payload = jwt.verify(oldToken, process.env.REFRESH_TOKEN_SECRET, {
      algorithms: ["HS256"],
      audience: "fintech-api",
      issuer: "my-fintech"
    });
  } catch (err) {
    return res.status(401).json({ message: "Invalid token" });
  }
  if (!sessions.has(payload.jti)) {
    revokeFamily(payload.sub); // reuse detected: burn everything
    return res.status(401).json({ message: "Reuse detected" });
  }
  sessions.delete(payload.jti);
  const tokenId = crypto.randomUUID();
  sessions.set(tokenId, { userId: payload.sub });
  const accessToken = jwt.sign({ sub: payload.sub },
    process.env.ACCESS_TOKEN_SECRET, { expiresIn: "15m" });
  const refreshToken = jwt.sign({ sub: payload.sub },
    process.env.REFRESH_TOKEN_SECRET, { expiresIn: "7d", jwtid: tokenId });
  res.cookie("refreshToken", refreshToken, {
    httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh"
  });
  res.json({ accessToken });
});

app.post("/auth/logout", (req, res) => {
  const token = req.cookies.refreshToken;
  if (token) {
    const decoded = jwt.decode(token);
    if (decoded && decoded.jti) sessions.delete(decoded.jti);
  }
  res.clearCookie("refreshToken", { path: "/auth/refresh" });
  res.json({ message: "Logged out" });
});

4. jsonwebtoken vs jose: Which Library in 2026?

Both libraries issue valid tokens, but they come from different eras. Here is how I choose between them for production work.

5. Where Each Token Lives: Cookies Done Right

Storage is where most implementations fail. The rule is simple: long-lived credentials must never be readable by JavaScript, and cookies must be scoped as narrowly as possible.

6. Rotation in Production: The Three Rhythms

Rotation is not a single endpoint — it is a lifecycle. These are the three rhythms I run in every fintech API I ship.

7. Common Mistakes That Get Fintechs Hacked

After reviewing several fintech auth implementations, the same flaws keep showing up. Check your codebase against both lists before shipping.

Conclusion

Short-lived access tokens limit the blast radius, rotation with reuse detection turns theft into an alarm, and httpOnly cookies keep long-lived credentials away from injected scripts. None of the three works alone — together they are the baseline OWASP expects from any API that moves money.

Start from the code in section 3, back it with a Redis jti store in production, and wire reuse-detection events into your alerting. Your future incident-response self will thank you — and if you want this implemented in your fintech API, you know where to find me.

Sources

• OWASP JSON Web Token Cheat Sheet
• auth0/node-jsonwebtoken — README and API docs
• panva/jose — README and API docs
• JWT Authentication: Refresh Token Rotation Best Practices in 2026
• JWT Access Token vs Refresh Token — Complete Guide (2026)