Access tokens, refresh token rotation, and theft detection: the parts most Node.js tutorials leave out.
A friend messaged me about his side project a few months ago:
"Someone else is logged into my account. I changed my password. They're still in."
He had followed the tutorials to the letter. Sign a JWT on login, send it to the frontend, keep it in localStorage, attach it to every request. Done.
What none of those tutorials mentioned is that this setup has no way to un-log anyone in. A JWT is a signed piece of paper. Once you hand it over, it stays valid until it expires, and his expired in 30 days. Changing the password accomplished nothing, because the token had already been signed and nothing about it depended on the password. There was no list of active sessions to delete from. There was nothing to revoke.
