ASVS 5.0 V10.4.8 (Level 2) says every refresh token must have an absolute expiration. That holds even when you use sliding expiration, where each use extends the token's life.
Sliding alone is not enough. A token used every week would never die, and neither would a thief's copy if they use it just as often.
Why it matters
An absolute limit puts a ceiling on how long any single login can persist. After it passes, the user signs in again, which is also a chance to re-evaluate their account status, risk and permissions.
How to implement it
Store two timestamps with each grant: an idle expiry that slides, and an absolute expiry set once at login that never moves.
from datetime import datetime, timedelta, timezone
IDLE = timedelta(days=14)
ABSOLUTE = timedelta(days=90)
def new_session_times(now=None):
now = now or datetime.now(timezone.utc)
return {"idle_expires": now + IDLE, "absolute_expires": now + ABSOLUTE}
def extend(times, now):
times["idle_expires"] = min(now + IDLE, times["absolute_expires"])
return times
Carry the original absolute expiry forward when rotating tokens. A common bug is to compute a fresh one for every new refresh token.
How to test it
Set short values in a test environment, such as 2 minutes idle and 5 minutes absolute. Refresh every minute. After 5 minutes the next refresh must fail even though the token was never idle. Confirm the new token from each rotation did not reset the absolute clock.
Choosing the numbers
Pick the absolute lifetime from risk, not habit. A banking app might allow 8 hours to 30 days depending on the device and the activity. A low risk reader app might allow 90 days. Shorter lifetimes cost the user a login, and you can soften that with passkeys or a fast single sign on. Write the chosen values in your security documentation so reviewers can compare them with the configuration.
Common mistakes
- Rotation that issues a new token with a brand new absolute lifetime.
- No expiry at all because the client is "trusted".
- Picking a lifetime in years.
Quick check
What does sliding expiration add to the absolute limit?
It lets active sessions continue up to the limit, but never beyond it.
