Why users get logged out at random, and how to fix JWT session bugs

Why are random logouts so hard to track down?

Because they depend on timing. The same user doing the same thing is logged in one time and logged out the next. Before changing code, log every authentication failure with its reason (expired, invalid signature, refresh token not found, refresh token already used) and the time on the server. The reason column usually points straight at the cause.

Cause 1: two requests refresh the same token at once

The access token expires. The page fires three API calls at the same moment; all three get a 401 and all three try to refresh. With refresh token rotation, the first refresh succeeds and invalidates the old refresh token, so the other two fail and the app logs the user out. Two open tabs do the same thing.

Fix it on the client by sharing one refresh at a time:

let refreshing = null

function refreshOnce() {
  if (!refreshing) {
    refreshing = api.post("/auth/refresh").finally(() => { refreshing = null })
  }
  return refreshing   // every caller waits for the same refresh
}

On the server, accept a refresh token that was rotated a few seconds ago and return the same new pair, so a duplicate refresh in that short window is not treated as theft.

Cause 2: expiry and clock differences

If the server that issues tokens and the server that checks them disagree on the time, a fresh token can look expired. Very short access tokens make this worse. Keep server clocks synced, allow a small clock tolerance when verifying, and refresh a little before expiry rather than after the first 401.

jwt.verify(token, secret, { clockTolerance: 30 })   // seconds

Cause 3: cookie settings drop the token

If the refresh token lives in a cookie, check its settings: the domain and path must cover the API, SameSite must allow the request your app makes, Secure requires HTTPS, and the cookie's own expiry must not be shorter than the refresh token's. A cookie that silently is not sent looks exactly like a random logout.

Cause 4: servers that do not share the same secret

Behind a load balancer, every instance must sign and verify with the same secret or key set. If one instance has an old or different secret, users are logged out whenever a request lands there, which looks random. The same happens during a secret rotation done without accepting both keys for a while.

How do you confirm the fix?

• Open the app in two tabs, wait for the access token to expire, and use both.
• Fire several API calls at once right after expiry.
• Watch the authentication failure log by reason; the logout reason you saw before should disappear.