Description
Ensure the access token (JWT) expiry time is set to a reasonable value, such as the default of 3600 seconds (1 hour) or shorter. Values longer than one hour should be avoided, and values below five minutes are also not recommended because they cause frequent token refreshes.
Rationale
An access token remains valid until it expires, even if the user signs out or their account is changed. The longer the expiry time, the longer a stolen token can be used by an attacker. Keeping the expiry at one hour or less limits this window, while the refresh token mechanism keeps legitimate users signed in.
Impact
Limits how long a stolen access token can be used
Changes to user access take effect sooner
Very short values increase load on the Auth server
Default Value
By default, access tokens expire after 3600 seconds (1 hour).
Pre-Requisites
Project Owner or Admin role
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Project Settings and select JWT Keys.
Check the Access token expiry time (shown on the Legacy JWT Secret tab in some projects).
If it is longer than 3600 seconds without a documented reason, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Project Settings and select JWT Keys.
Set Access token expiry time to 3600 seconds or less.
Select Save.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Project Settings and select JWT Keys.
Set Access token expiry time back to its previous value.
Select Save.
Reference