Is there any maximum value enforced or recommended by PCI-DSS for the expiration of the access and refresh JWT?

If not enforced, what is an appropriate value to avoid problems during audits?


Overall the JWT is used on a web login to access pages, so unless you have done something crazy like allowing cmd shell access (can we say major treat), you have 100% control over the time, it is your users and clients login and PCI does not really say much about it.

Really it is just another cookie, so what are your polices for cookie expire?

Now you enter the realm of best pratices....

Is this JWT being used by an administrator of the system where they can access CHD; e.g. PAN? If so, you should consider MFA, and I would treat it on a 1 by 1 access with 5 minute timeout.

If this JWT is for your clients/CSRs that is a business decision. I personally would max set the timeout to 15-60 minutes of no activity and refresh it only if they submit a page. You could get fancy and ask them to renew, but that is up to you and your security policies. This way it does not expire if they are doing work, but if they step out for lunch, then it closes down the session.

I have seen values as large as 10 hours (to cover a work day for CSRs), and as little as 5 mintues to cover very specific use cases; e.g. CHD access for refund processing.

Regardless of what time you choose, edit your policies to back it up. Because it is a business decision, you want to have documentation that says what the value is from a business CYA position.

  • That makes things much clearer. Thanks. I was concerned because PCI-DSS mentions that we must take actions to ensure an access token is not usable after it's been revoked, yet you can't really revoke a JWT. Feb 26 '18 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.