2026-07-13 · 6 min read · Rahul Chitturi
- jwt
- auth
- security
Refresh token rotation bugs are stressful because the user sees a simple sign-in loop while the backend is trying to protect the session from replay. A token can be validly issued, then rejected because a newer refresh token already replaced it, a cookie was scoped incorrectly, or clocks disagree about expiry.
Start by separating the visible JWT payload from the server-side rotation record. Decoding claims helps you inspect issuer, audience, subject, and timestamps, but replay detection usually depends on stored token IDs, hashes, or session version numbers that are not visible in the token alone.
Check rotation state before changing expiry
Teams often lengthen token lifetimes when users report random logouts. That can hide the real problem and weaken session security. Instead, compare the failing request with the last successful refresh and confirm which token the server expected at that moment.
- Decode exp, nbf, iat, iss, aud, and jti from non-production or redacted tokens
- Convert token timestamps to the same timezone as auth logs
- Compare cookie domain, path, SameSite, and Secure attributes across environments
- Check whether parallel browser tabs are racing to rotate the same refresh token
Make replay evidence reviewable
A safe incident note should show token shape without leaking usable credentials. Redact token strings, preserve claim names, and keep only synthetic identifiers when comparing sessions. If the server stores token hashes, compare the hash lifecycle rather than copying the original secret value.
Diff old and new cookie settings, middleware behavior, and auth responses together. Rotation bugs often appear after a small frontend navigation change or an infrastructure proxy starts dropping a Set-Cookie header.
A Flashman workflow
Use the JWT decoder to inspect safe sample claims, the timestamp converter to align expiry values with logs, the JSON formatter for auth responses, and the diff tool to compare cookie or middleware changes.
Keep real access and refresh tokens out of shared tools and tickets. Use staging tokens or hand-built examples that prove the rotation sequence without granting access to an account.