JWT Authentication
JWT ke TEEN parts hain — header, payload, signature — dot se separated. Payload ENCODED hai, ENCRYPTED NAHI: koi bhi use base64-decode karke padh sakta hai. Isliye password ya sensitive data JWT mein kabhi mat daalo.
Signature server ke secret se banta hai, isliye token TAMPER-PROOF hai — payload badla to signature match nahi karega. Verification middleware har protected route se pehle chalta hai aur req.user set kar deta hai.
const jwt = require("jsonwebtoken");
const token = jwt.sign({ id: user.id, role: user.role },
process.env.JWT_SECRET, { expiresIn: "15m" });
function requireAuth(req, res, next) {
const token = req.headers.authorization?.split(" ")[1];
if (!token) return res.status(401).json({ error: "No token" });
try { req.user = jwt.verify(token, process.env.JWT_SECRET); next(); }
catch { res.status(401).json({ error: "Invalid or expired token" }); }
}- JWT = header.payload.signature, payload sirf encoded hai encrypted nahi
- Secret se bana signature tampering rok deta hai
- Short expiry + refresh token, aur sensitive data payload mein kabhi nahi
JWT ka format hai header.payload.signature — teenon base64url encoded. Header algorithm batata hai (HS256, RS256), payload mein claims hote hain (sub, role, iat, exp), aur signature server ke secret se banta hai. Payload ENCRYPTED NAHI hai — jwt.io par koi bhi use padh sakta hai.
// payload — sirf non-sensitive data
jwt.sign({ sub: user.id, role: user.role },
process.env.JWT_SECRET,
{ expiresIn: "15m", issuer: "code10x" });Access token short-lived (15 min) rakha jaata hai aur har request ke saath jaata hai. Refresh token long-lived hota hai, httpOnly cookie mein rakha jaata hai aur sirf naya access token lene ke liye use hota hai. Refresh token DB mein store hota hai taaki logout par revoke kiya ja sake.
app.post("/auth/refresh", async (req, res) => {
const rt = req.cookies.refreshToken;
const stored = await tokenRepo.find(rt);
if (!stored || stored.revoked) return res.status(401).json({ error: "Invalid" });
res.json({ accessToken: issueAccessToken(stored.userId) });
});