The token has no exp (expiration time) claim, so it is valid forever as far as the token itself is concerned. A token that leaks through logs, browser history, a proxy or a compromised device stays usable until the signing key is changed.

1. Always set exp when issuing a token and enforce it when verifying.

2. Keep access tokens short lived, for example a few minutes to an hour, and renew them with refresh tokens.

3. Add a revocation mechanism (token identifier list, key rotation or a server side session) for the cases where a token must be cut off before it expires.

• CWE-613: Insufficient Session Expiration
• RFC 8725: JSON Web Token Best Current Practices