Key takeaways
- Passwords are hashed with Argon2id
- Access tokens last 15 minutes; refresh tokens last 7 days and rotate on every use
- Reusing a rotated refresh token signals theft and is detected
- Rate limiting and account lockout slow down credential guessing
Hash passwords properly
Argon2id is memory-hard, which makes large-scale guessing expensive. Passwords are never stored or logged in a recoverable form.
Short access, rotating refresh
A 15-minute access token limits what a stolen token can do. A 7-day refresh token, bound to a device and stored only as a hash, is exchanged for a new pair on each refresh, and the old one is revoked.
Detecting reuse
If a refresh token that has already been rotated shows up again, either the user or an attacker is holding a stale copy. Treating that as a theft signal lets the system revoke the session instead of quietly issuing new tokens.
Slow down guessing
A sliding-window limiter on login, keyed by email and IP, counts failures and locks the account for a cooldown after too many. Lockouts are written to the audit log, and two-factor authentication adds a second barrier.