Your JWTs last one hour. An employee is dismissed. Security asks why they still had system access for 45 minutes. Explain and fix.

What the interviewer is testing

Whether you understand the revocation gap inherent to self-contained tokens and can propose proportionate remedies.

The explanation

Self-contained tokens are validated by checking a signature, with no call to the issuer. That is what makes them scalable and it is exactly what makes revocation hard — the resource server never asks anyone whether the token is still valid.

So a token remains effective until it expires, regardless of account status. One hour of lifetime is one hour of access after dismissal, compromise or role change.

The options, with costs

Short lifetimes — 5 to 15 minutes — with refresh tokens. The revocation check moves to the refresh exchange, which does call the issuer. This is the standard answer and reduces the window to the token lifetime. It costs more refresh traffic and is the right default.

A denylist of revoked token identifiers, checked on each request. Restores immediate revocation and reintroduces the shared state that self-contained tokens were adopted to avoid — though a small denylist replicated to a local cache is a reasonable compromise, since the number of active revocations is tiny.

Introspection on every request. Correct, and it gives up the scalability entirely.

Session invalidation events pushed to services, which act on them. Effective and requires every consumer to implement the subscriber.

The decision to make explicitly

What is the maximum acceptable revocation delay for this system? Fifteen minutes is fine for most internal tools and unacceptable for administrative access to production, for financial transactions, or for anything where a session must end on a safeguarding decision.

Different answers can coexist by issuing different lifetimes per audience — short for high-privilege scopes, longer for read-only ones.

What a strong answer adds

The offboarding path matters more than the token design. Disabling the account in the identity provider must propagate to every system, including ones using their own local accounts, and the 45-minute question usually reveals that some systems would never have learned at all.

Common weak answers

Shortening the lifetime with no analysis of the requirement. Claiming JWTs cannot be revoked.