Cybersecurity glossary
What is JWT Token Replay?
Learn what JWT token replay is, how stolen or intercepted bearer tokens are reused, why long lifetimes amplify impact, and which binding, expiry, and revocation controls reduce replay risk.
Definition
JWT token replay is the reuse of a previously issued JSON Web Token by an attacker or unintended party to gain authorized access, typically after theft from browsers, logs, mobile storage, network interception, or cross-site leakage, while the token remains cryptographically valid.
Why JWT replay matters
A correctly signed JWT is a portable capability. JWT token replay abuses that portability: the attacker does not break signatures—they present a token that is still valid after stealing it from a client, log line, cache, or compromised device.
Replay is therefore an operations and lifecycle problem as much as a crypto problem. Long-lived bearer JWTs turn a single leak into durable account takeover.
Where replayed tokens come from
Browser XSS and storage
Scripts read tokens from localStorage, sessionStorage, or accessible JavaScript memory.
Log and analytics leakage
Authorization headers and URLs with tokens are written to centralized logs.
Malware and device theft
Mobile or desktop compromise exfiltrates cached access tokens.
Misdirected clients
Tokens sent to wrong hosts via open redirects or mixed-content mistakes.
How a replay attack typically runs
Obtain a valid JWT
Steal or intercept a still-unexpired access token.
Reuse from attacker infrastructure
Call APIs with the same Authorization bearer value.
Act within token scopes
Perform whatever the claims and authorization model allow.
Stay under expiry
Continue until exp passes or revocation takes effect.
Optionally refresh
If a refresh token was also stolen, mint new access tokens.
Cover tracks
Distribute requests to blend with legitimate usage patterns.
Controls that shrink replay impact
| Control | Effect on replay |
|---|---|
| Short access-token TTL | Limits how long a stolen JWT remains useful |
| Refresh rotation + reuse detection | Detects parallel use of stolen refresh tokens |
| Sender constraining / mTLS / DPoP | Binds tokens to a proof-of-possession key |
| jti denylist / introspection | Enables explicit revocation before exp |
| Secure cookie storage (HttpOnly) | Reduces XSS token exfiltration surface |
| Anomaly detection on IP/device | Flags sudden reuse from new contexts |
Anti-replay checklist
- Issue short-lived access JWTs; keep long sessions via refresh rotation.
- Avoid putting bearer tokens in URLs; prefer headers or secure cookies.
- Scrub Authorization values from logs, crash reports, and analytics.
- Consider demonstration-of-possession profiles for high-risk APIs.
- Support emergency revocation with jti tracking or introspection.
- Detect impossible travel and multi-geo concurrent use of the same token.
- Educate client teams not to persist access tokens in world-readable storage.
- Treat replayed refresh tokens as credential compromise incidents.
The practical takeaway
JWT token replay reuses a real, still-valid token after theft. Signatures do not stop it—lifecycle controls do.
Shorten lifetimes, protect storage, constrain senders where warranted, and plan revocation. For related theft patterns in OAuth deployments, see OAuth Token Theft.
Related security terms
Access Token
The credential most often replayed against APIs after theft.
Expiration Claim (exp)
Primary lifetime control that bounds replay windows.
OAuth Token Theft
How OAuth access and refresh tokens are stolen and abused.
Session Hijacking
Related takeover pattern when session identifiers are replayed.
JWT (JSON Web Token)
Token format whose bearer nature enables replay when leaked.
Frequently asked questions
What is JWT token replay in simple terms?
Someone steals a valid login token and reuses it before it expires. Because many APIs only check that the token is signed and not expired, the thief can act as the user.
Is replay the same as forging a JWT?
No. Forgery creates a new token without the issuer’s key. Replay reuses a real token that was already issued and signed.
Why are JWTs easy to replay?
Bearer tokens are portable by design. Whoever presents a valid token is treated as authorized unless extra binding or revocation controls exist.
Does short expiry stop replay?
It shrinks the window. It does not eliminate replay during the token’s lifetime, so pair short TTL with secure storage, TLS, and monitoring.
What is the jti claim used for?
jti is a unique token identifier. Servers can track jti values to detect reuse, enforce one-time tokens, or support revocation lists.
Can refresh tokens be replayed too?
Yes, and impact is often worse. Use refresh rotation, reuse detection, and hardened storage for refresh credentials.
Does HTTPS prevent replay?
HTTPS stops many network interceptions but not theft from XSS, malware, misconfigured logs, or malicious browser extensions.
References
Explore authoritative guidance and frameworks related to jwt token replay.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.