Token Expiration
Problem
An attacker steals an access token.
If it remains valid forever, one theft provides permanent access.
Solution — Expiration
Tokens carry limited lifetimes.
issued: 10:00
expires: 10:15
After expiration, the token is no longer accepted.
Core idea: short-lived credentials limit how long stolen authority remains useful.