Code10x
Secretssenior8+ years

A service issues JWT access tokens signed with `secret-A`, each valid for 15 minutes, with no server-side record of issued tokens. At 10:00 the team deploys `secret-B` and updates the verifier to accept both secrets. What is the earliest moment it's safe to make the verifier stop accepting `secret-A`, and why is that moment forced rather than a judgment call?

10:15 — a full token lifetime after the deploy, not the moment secret-B goes live. The instant secret-B is deployed, tokens signed under the old secret-A are still out in the world — in browsers, in mobile clients, wherever they were issued before the rotation — and they stay valid until their own 15-minute expiry, completely independent of when the server-side rotation happened. If the verifier drops secret-A acceptance the moment secret-B goes live, every caller still holding an unexpired secret-A token gets rejected mid-session, turning a rotation that should be invisible into a self-inflicted mass sign-out. The last secret-A token could have been minted right up until 10:00, and it expires at 10:15 — only after that moment has every possible secret-A token actually expired, and only then is dropping secret-A acceptance harmless rather than disruptive.

The lesson behind it →
PreviousA service accepts a URL from the client and fetches it to generate a link preview. A teammate proposes blocking requests to URLs containing `169.254.169.254` or `localhost`. Why is that an incomplete defense against SSRF, and what would a defense-in-depth version actually look like?Next A team currently uses bcrypt and is evaluating a move to scrypt or Argon2id, reasoning that "they're all slow, adjustable password hashes, so it's a lateral move." What's actually different about scrypt's memory-hardness compared to bcrypt's CPU cost, and why does that distinction matter for what an attacker can practically do?
More on Secrets
A token was committed, noticed the next day, and removed in a follow-up commit — the working tree is clean and `git log` shows a commit titled "Move the token to an environment variable." Is this incident closed? Walk through what you'd actually do.