PCI-DSS合规服务中JWT有效期及过期最大值规范问询

Great question—let’s break this down clearly since PCI-DSS can feel a bit vague on token specifics at first glance. Let’s start with the key points:

Core PCI-DSS Context #

First off: PCI-DSS does not explicitly mandate hard maximum expiration times for either access or refresh JWTs. Instead, it focuses on broader security principles that your token strategy needs to align with—specifically:

• Requirement 8: Enforcing strong authentication and least privilege for system access
• Requirement 10: Tracking session activity and ensuring sessions can be terminated when no longer needed

Access JWT Recommendations #

For access tokens (the ones that grant direct access to cardholder data or sensitive systems), the industry standard (and what auditors will expect) is a short expiration window—typically between 5 to 15 minutes. Here’s why:

• Shorter tokens minimize the window of opportunity if a token gets stolen or compromised.
• It forces frequent re-authentication (via refresh tokens or re-login), which aligns with PCI’s focus on reducing persistent access risks.
• Avoid setting access tokens to anything longer than 1 hour unless you have a documented, low-risk business case that justifies it—auditors will flag overly long access tokens as a potential vulnerability.

Refresh JWT Guidelines #

Refresh tokens are used to get new access tokens without re-prompting the user, so the balance here is security vs. user experience. Again, no PCI mandate, but follow these best practices to avoid audit issues:

• If stored securely (e.g., in HttpOnly, secure, SameSite cookies), 24 hours to 7 days is a reasonable range.
• If stored in less secure locations (like browser local storage, which is vulnerable to XSS), cap refresh tokens at 12 hours max—local storage exposes tokens to more risk, so shorter expiration reduces that exposure.
• Critical: Implement refresh token rotation (invalidate old tokens when a new one is issued) and allow users to revoke refresh tokens (e.g., a "logout from all devices" feature). This directly addresses PCI’s requirement to terminate sessions when they’re no longer needed.

How to Avoid Audit Pushback #

Even without hard rules, auditors will judge your strategy based on risk alignment. To stay on their good side:

• Document everything: Write down why you chose your expiration times (e.g., "10-minute access tokens to reduce compromise window; 7-day refresh tokens stored in secure cookies to balance security and user experience").
• Stick to least privilege: Ensure tokens only carry the permissions needed for the current user’s session, and that expired tokens are immediately invalidated.
• Log token activity: Track issuance, usage, and expiration events—this ties into PCI Requirement 10’s logging mandates for monitoring access to sensitive data.
• Avoid extreme values: Don’t set access tokens to 24 hours or refresh tokens to 30 days unless you can prove the risk is negligible (and even then, auditors may push back).

内容的提问来源于stack exchange，提问作者user8808265