How are access tokens managed and protected?
amaise uses stateless tokens with tiered lifetimes:
Category | Validity | Usage |
Short-lived | Minutes | User access tokens, database tokens |
Medium-term | Hours – days | Refresh tokens, authentication sessions |
Long-lived | Configurable | Machine-to-machine integrations (API) |
All tokens are RS256-signed (JWT) with issuer whitelist and audience validation. Refresh tokens rotate on each renewal — the old token becomes invalid immediately.
Important: Tokens are stored only in memory on the frontend — never in localStorage or sessionStorage. This protects them from XSS attacks targeting persistent storage.
There are no server-side sessions (stateless). This prevents session hijacking and session fixation attacks.