Skip to lesson
Exit
Deep Dive - Authentication Architecture1 / 2

1 min lesson

The compromise everyone actually ships

Explain the order in "The compromise everyone actually ships", then say how you would verify the result.

Step 1 of 2

The compromise everyone actually shipsshort access + long refresh

Production auth rarely picks a pure side. The standard pattern: a short-lived access JWT (5–15 minutes) for the hot path, a long-lived refresh token (days to weeks) held more carefully and a revocation check that runs only at refresh time.

  1. 1Issue. On login, mint an access JWT (~10 min) plus a refresh token tied to a server record.
  2. 2Serve. Verify the access JWT locally on every request - no DB hit, this is the throughput win.
  3. 3Refresh. When it expires, the client trades the refresh token for a new access JWT; this is the moment you check revocation and a token_version.
  4. 4Revoke. Bump the user's token_version or delete the refresh record; within one access-token TTL, all their tokens stop refreshing.

That token_version (or session_epoch) column is the trick that buys you near-instant revocation without paying for a lookup on every request. You accept a bounded staleness window equal to the access-token lifetime - make it short and that window is minutes, not days.