Direct answer
A signed token must be validated for its applicable lifetime and token profile. Revocation behavior depends on the architecture, so compare actual access after logout or credential changes with the documented policy.
Define token roles
Identify access tokens, refresh tokens, issuing authority, intended resource server and expected lifetimes. Use a dedicated identity and avoid preserving live tokens in reports. Ask the owner what logout and password change should invalidate.
Reference: OWASP REST Security Cheat Sheet.
Check time and audience
Use normally issued valid and expired test tokens against a harmless protected endpoint. Verify rejection after the applicable expiry and account for clocks and documented tolerance. Do not alter signed claims and treat signature failure as proof of expiry validation.
- Record token type, issued time and observed result without the token value.
- Check the intended issuer and audience separately.
- Test refresh behavior only within the agreed scope.
Test termination
Where policy promises revocation, log out or revoke the test session, then retry the prior credential and refresh path. A stateless access token may remain valid until expiry unless the design includes an effective revocation mechanism; report the observed window accurately.
Retest after changes
Repeat valid, expired and terminated-session cases, and verify a legitimate renewed session works. Document remaining lifetime, scope and any identity-provider propagation delay rather than claiming all devices were signed out.
Assessment limits
Token profiles and providers differ. A single service test does not prove revocation across all resource servers, refresh grants or federated sessions.
Frequently asked questions
Does logout always invalidate a JWT immediately?
Not necessarily. It depends on the application's token lifetime and revocation design; verify the promised behavior.
Does editing exp in a token test expiry?
Changing a signed token invalidates its signature. Use an actually issued expired test token to isolate expiry handling.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.