JWT Authentication
JWT (JSON Web Token), EK, SELF-CONTAINED, TOKEN, hai — THREE, PARTS, HOTE, HAIN, HEADER.PAYLOAD.SIGNATURE — USER, INFORMATION, aur, EXPIRY, TOKEN, ke, ANDAR, HI, ENCODED, HOTI, hai (ENCRYPTED, NAHI, SIRF, ENCODED — SENSITIVE, DATA, MAT, DAALO).
SERVER, TOKEN, ko, EK, SECRET, KEY, se, SIGN, karta hai — HAR, REQUEST, PAR, SIGNATURE, VERIFY, ki, jaati hai, TAAKI, PATA, CHALE, ki, TOKEN, TAMPER, NAHI, HUA. STATELESS, hai — SERVER, ko, SESSION, DATABASE, mein, KUCH, STORE, karne, ki, ZAROORAT, NAHI.
const jwt = require("jsonwebtoken");
// Login route — token generate:
app.post("/login", async (req, res) => {
const user = await validateCredentials(req.body);
const token = jwt.sign({ userId: user.id }, process.env.JWT_SECRET, { expiresIn: "1h" });
res.json({ token });
});
// Protected route — token verify:
function requireAuth(req, res, next) {
const token = req.headers.authorization?.split(" ")[1];
try {
req.user = jwt.verify(token, process.env.JWT_SECRET);
next();
} catch {
res.status(401).json({ error: "Invalid token" });
}
}- JWT = self-contained token, HEADER.PAYLOAD.SIGNATURE, format, mein
- Stateless — server, ko, session, database, mein, KUCH, STORE, karne, ki, ZAROORAT, NAHI
- Payload, encoded, hai, encrypted, NAHI — sensitive, data, MAT, DAALO
Access, tokens, SHORT-LIVED, (jaise, 15 min) HOTE, HAIN, SECURITY, ke, liye — Refresh, tokens, LONG-LIVED, HOTE, HAIN, aur, DATABASE, mein, STORE, kiye, jaate, HAIN, TAAKI, NAYA, access, token, ISSUE, kiya, ja, sake, bina, USER, ko, DOBARA, LOGIN, karaye.
app.post("/refresh", async (req, res) => {
const { refreshToken } = req.body;
const stored = await db.findRefreshToken(refreshToken);
if (!stored) return res.status(401).json({ error: "Invalid refresh token" });
const newAccessToken = jwt.sign({ userId: stored.userId }, process.env.JWT_SECRET, { expiresIn: "15m" });
res.json({ accessToken: newAccessToken });
});JWT, ko, localStorage, mein, STORE, karna, XSS, ATTACKS, ke, liye, VULNERABLE, hai — httpOnly, COOKIES, MORE, SECURE, OPTION, HAIN, kyunki, JavaScript, INKO, ACCESS, NAHI, kar, sakta.