Scenario: an admin token leaks Intermediate

An admin access token with a 24-hour lifetime shows up in a log screenshot on a public issue. You have four decisions: block the token, find the scope of impact, deal with the signing secret, and fix the design so the next time is not this expensive.

• The question to answer at every step: is the token still usable, and who can still sign tokens?
• Scoring counts only your first choice at each step.

Scenario

An admin token in a public screenshot

You are the on-call backend lead. The system uses self-contained HS256 JWTs: access tokens live 24 hours, refresh tokens 30 days and are stored in the DB. Every choice immediately shows its consequences on the metrics.

Leaked token still usable21 hours

Requests to inspect by hand0

Signing key leaked (forgeable)0

Users forced to log in again0

Token leak paths still open3

Step 1/4 · The token has 21 hours left

09:10, a dev pastes a screenshot of nginx logs into a public GitHub issue to ask about an export bug. The screenshot contains a full access token for admin-07, issued at 06:10, with 21 hours left before exp. The issue has been public for 40 minutes.

token type

self-contained JWT, verified locally

time to exp

21 hours

users logged in

118,000

GET /admin/reports/export?access_token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbi0wNyIsInJvbGUiOiJhZG1pbiIsImp0aSI6IjdmM2EuLi4iLCJleHAiOi4uLn0.Q2x...
// payload: {"sub":"admin-07","role":"admin","jti":"7f3a...","iat":...,"exp":... (+24h)}

What do you do?

ADelete the issue, the screenshot, and the log line containing the tokenBDenylist the token's jti (Redis, TTL until exp) checked in middleware, bump admin-07's session_version, revoke the admin's refresh token familyCRotate the signing secret now, invalidating every old tokenDMake admin-07 change their password and click "Log out of all devices"

After playing, read Session cookie or JWT for the ways to revoke a JWT and a refresh token rotation demo with reuse detection.