Sessions and JWTs

Navi grants access with a JWT that authorizes requests, inside a session that maintains continuity; the two have different lifetimes.

A short JWT limits what a leaked token is worth, and the longer session keeps a stakeholder from being interrupted mid-form.

The JWT is much shorter-lived than the session

Navi refreshes the JWT within the session, so nobody is asked to re-authenticate mid-form.

The host backend requests the session; Navi issues the JWT

1. The host backend requests a session for a specific person.
2. Navi issues a short-lived JWT within that session.
3. The client uses the JWT for requests, and it's refreshed as needed while the session lives.

Mint sessions server-side and keep JWT lifetimes short

• Mint sessions server-side. Session creation belongs on the backend, never in client code.
• Keep JWT lifetimes short. The default is short for a reason; lengthening it trades security for convenience.
• Treat a session as one person's access, not a shared resource.

Next steps

Next: Branding and theming.