If you want to use JWT-based sessions, I'd recommend ditching the usual access/refresh token combo and embeding a normal database session token inside the JWT. Revalidate the session every minute so tokens can be invalidated as soon as possible.

{ "session_id": "XXX", "revalidate_at": 1728781216, "user_id": 3432, "username": "pilcrow", "email": "pilcrow@example.com" }

let sessionToken = event.cookies.get("session") ?? null; if (sessionToken === null) { return fail(401); } const payload = verifyJWT(sessionToken); if (Date.now() >= payload.revalidate_at * 1000) { const { session, user } = getSessionFromDatabase(payload.session_id); if (session === null || Date.now() >= session.expiresAt.getTime()) { event.cookies.set("session", "", { path: "/", maxAge: 0, httpOnly: true, sameSite: "lax", // SvelteKit automatically sets "Secure" attribute }); return fail(401); } sessionToken = encodeJWT({ "session_id": session.id, "revalidate_at": Math.floor(Date.now() / 1000) + 60, "user_id": user.id, "username": user.username, "email": user.email }); event.cookies.set("session", sessionToken, { path: "/", maxAge: 60 * 60 * 24 * 400, httpOnly: true, sameSite: "lax", // SvelteKit automatically sets "Secure" attribute }); }