The token stays valid for a very long time, many days or more according to its iat and exp claims. The longer a bearer token lives, the larger the window in which a leaked token can be replayed, and the more likely it is that it is still valid when it leaks.

1. Shorten the lifetime of access tokens to minutes or hours.

2. Use refresh tokens for long sessions, store them server side, rotate them on every use and revoke them on logout and on password change.

3. Bind long lived credentials to the client where possible, for example with sender constrained tokens.

• CWE-613: Insufficient Session Expiration
• RFC 8725: JSON Web Token Best Current Practices