Authentication · Verified identity
Refresh, logout and token revocation
Short access tokens, rotating refresh tokens and the limits of logout.
Understand the concept
A refresh token can obtain new access tokens after expiry. It is a sensitive credential and is not issued in every client flow. Rotation replaces its value on renewal. Reuse detection can revoke a token family, but concurrent tabs and requests require deliberate race handling.
Logout is more than clearing browser storage. Revoking a server session or refresh access, ending an identity-provider session, and clearing correctly scoped cookies are separate actions. A self-contained signed access token may remain usable until expiry. Immediate revocation needs an architectural decision such as server-side checks or introspection.
A client may perform a bounded refresh after 401 and share one renewal across concurrent requests. Avoid infinite refresh, renewal on every 403, and unsafe replay of side effects. Reflect failures consistently in the UI without leaking tokens into telemetry.
For reliable renewal in long-lived SaaS sessions.
Assuming logout automatically invalidates all issued JWTs.
One topic. Three levels of depth.
401 → one refresh attempt → retry only if safeRenewal is bounded and operation replay must separately be safe.
This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.
Try it yourself first.
The user cleared localStorage. Does a stolen access token stop immediately?
Show the solution and explanation
Not necessarily: check token lifetime and revocation architecture.Not necessarily; it depends on server-side revocation checks.