JWT Auth Done Right

JWTs are everywhere but most implementations have security holes. Here's how to do it properly.

Token Strategy

• Access token — short-lived (15 min), stored in memory
• Refresh token — long-lived (7 days), stored in httpOnly cookie
• Token rotation — issue new refresh token on each use

Common Mistakes

• Storing JWTs in localStorage (XSS vulnerable)
• No token expiration (compromised tokens live forever)
• Not validating token signatures on every request

My Setup

Access tokens in memory, refresh tokens in httpOnly secure cookies. Automatic token refresh on 401 responses. Token rotation with reuse detection for security.

Tips

• Always use HTTPS in production
• Implement token revocation for logout
• Keep access token payloads small