I am going to implement JWT authentication for several independent services.
There will be auth.example.com and service1.example.com, service2.example.com etc.
My assumptions:
- JWT can be kept in cookie for ".example.com"
- JWT expire time should be small (like 15 mins) because there is no reliable way to logout user with JWT token (revoke token).
- Refresh tokens should be used to reissue JWT tokens
- Refresh token cookies should be accessible only by auth.example.com for security reasons and because https://tools.ietf.org/html/rfc6749#section-1.5 says
"Unlike access …