JWT token management in HR SaaS: pitfalls to avoid

JWT: quick refresher

JWTs are the de facto standard for authentication in SaaS. A signed token containing user information (ID, organization, role) that can be verified without a database call.

It's simple and performant. But that simplicity hides pitfalls that many HR vendors discover too late.

Pitfall 1: tokens that never expire

We see this regularly: access tokens with a 30-day lifetime, or no expiration at all. The argument is always the same: "we don't want users to log in too often."

The problem: if a token is stolen (XSS, network interception, compromised device), the attacker has access for 30 days. And since the JWT is self-contained, you can't revoke it server-side — it stays valid until expiration.

Recommendation: access tokens of 15 minutes maximum. Refresh tokens of 7 days with rotation on each use.

Pitfall 2: storing the JWT in localStorage

localStorage is accessible by any JavaScript on the page. An XSS flaw — even in a third-party dependency — allows stealing the token.

Recommendation: store the refresh token in an httpOnly, secure, SameSite=Strict cookie. The access token can stay in memory (JavaScript variable) — it's ephemeral anyway.

Pitfall 3: not verifying the signature

It sounds absurd, but we've seen it: the backend decodes the JWT without verifying the signature. Anyone can modify the payload (change the role from "user" to "admin") and the backend accepts it.

Always verify the signature with the secret or public key. And never accept the "none" algorithm.

Pitfall 4: overly broad claims

A JWT containing role, organization, but also email, name, department, manager... that's too much. The JWT is visible to the client (it's base64, not encryption). Limit yourself to claims necessary for authorization.

Pitfall 5: no revocation mechanism

When an employee leaves, when a user reports session theft, when you detect suspicious activity — you need to revoke the token immediately.

With short access tokens (15 min), the exposure window is limited. But for refresh tokens, maintain a revocation list (blacklist) in database or Redis cache.

JWT checklist for your HR SaaS

If you're unsure about your implementation, a CleanIssue First Review can verify these points in 48h.