JWT Authentication Qu' lIj

JSON Web Tokens law' new backends Daq default choose (token right fit'a' check pagh, revoke jaj nuq qaS Sov pagh). JWT nuq, chay' lo', nuqDaq Dun pagh.

JWT Daq nuq

JWT wej base64url-encoded segments (dots rap): header.payload.signature. signature neH secret-dependent - header 'ej payload encoded neH (encrypted pagh), Hoch decode 'ej laD laH.

// header
{ "alg": "HS256", "typ": "JWT" }

// payload (the "claims")
{ "sub": "user_4821", "role": "admin", "exp": 1774300800 }

// signature = HMAC-SHA256(base64url(header) + "." + base64url(payload), secret)

last point repeat: payload Daq secret chel Qo'. JWT payload signed qaSDI' tampered pagh prove - payload token holder pagh vay' hide pagh.

token issue

import jwt from 'jsonwebtoken';

function issueToken(user) {
  return jwt.sign(
    {
      sub: user.id,
      role: user.role,
    },
    process.env.JWT_SECRET,
    { expiresIn: '15m' },
  );
}

expiresIn exp claim set - time passes vaj token structurally invalid verify, server vay' track poQ pagh. statelessness JWT appeal: shared secret (pagh public key) ghaj server Hoch token verify, database lookup pagh session store call pagh.

token verify

function requireAuth(req, res, next) {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'missing_token' });
  }

  try {
    const payload = jwt.verify(authHeader.slice(7), process.env.JWT_SECRET);
    req.user = { id: payload.sub, role: payload.role };
    next();
  } catch (err) {
    return res.status(401).json({ error: 'invalid_token' });
  }
}

jwt.verify signature 'ej expiry wa' call Daq check, fail vaj throw. library reH Qu': signature comparison hand-roll timing-attack pagh type-confusion bug (JWT vulnerability class real: servers token alg field trust, attacker alg: none switch verification skip; modern libraries accepted algorithms explicit specify).

revocation Qagh

statelessness JWT selling point 'ej sharpest edge: database pagh check vaj specific token expire qaSpa' invalidate laHbe'. user password choH, logout, ban - existing token exp Dung Qu', "verify signature" "token honor'a'?" jang pagh.

wej ways (statelessness law' give up):

1. Short expiry + refresh tokens. short-lived access token (minutes) 'ej longer-lived database-tracked refresh token. access revoke refresh token record delete; access token natural expiry Dung Qu' 'ach window small.

// on login
const accessToken = jwt.sign({ sub: user.id }, secret, { expiresIn: '15m' });
const refreshToken = crypto.randomUUID();
await db.refreshTokens.insert({ token: refreshToken, userId: user.id, expiresAt: /* 30 days */ });

// on refresh
async function refresh(refreshToken) {
  const record = await db.refreshTokens.findValid(refreshToken);
  if (!record) throw new Error('invalid_refresh_token');
  return jwt.sign({ sub: record.userId }, secret, { expiresIn: '15m' });
}

1. rare urgent case denylist. small fast-to-check store (Redis, TTL token remaining lifetime rap) tokens immediately reject: stolen token, emergency ban - signature verification rap Hoch request check. hot path Daq lookup chel 'ach exceptional case neH (token Hoch pagh).

1. sessions neH lo'. denylist most tokens law' cover vaj server-side sessions reinvent. instant revocation qatlh 'ej traffic JWT cross-service statelessness poQ pagh vaj traditional session ID (database pagh Redis) simpler, JWT structurally bad thing Qu'.

storage bite

access token localStorage Daq vaj page JavaScript Hoch laD laH - XSS injected script je. httpOnly cookie JavaScript laD laHbe' - hole close 'ach CSRF open (browsers cookies automatically attach, site trigger Hoch).

res.cookie('access_token', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
});

sameSite: 'strict' (pagh 'lax') CSRF mitigate: browser cookie different site requests attach Qotlh.

JWT wrong tool

• single monolith (request Hoch own database talk). JWT complexity cost pay (revocation strategy, signature key management) statelessness benefit use pagh - session lookup database already hit.
• user everywhere logout right now hard requirement: password reset, account compromise. denylist pagh refresh-token revocation day one plan (incident Daq gap discover pagh).

yaj

JWT signed (encrypted pagh) identity claim, server database round trip pagh verify - service boundaries Daq useful (shared session store awkward). tradeoff revocation free pagh: short-lived tokens refresh rap, denylist emergencies, JWT statelessness poQ pagh decide.