jwt-security

JWT Security

Secure implementation of JSON Web Tokens for authentication.

When to Use

• Implementing JWT authentication
• Reviewing existing JWT code
• Setting up refresh token rotation
• Debugging JWT issues
• Migrating to JWT-based auth

JWT Vulnerabilities

Vulnerability	Risk	Description
Algorithm None	CRITICAL	Accepting unsigned tokens
Algorithm Confusion	CRITICAL	RS256 → HS256 attack
Weak Secret	HIGH	Brute-forceable secrets
No Expiration	HIGH	Tokens valid forever
Sensitive Data in Payload	MEDIUM	JWT payload is base64, not encrypted
Token Leakage	HIGH	Exposed in logs/URLs

Secure Implementation

1. Token Generation

const jwt = require('jsonwebtoken');

const JWT_CONFIG = {
  accessSecret: process.env.JWT_ACCESS_SECRET,   // 256+ bit random string
  refreshSecret: process.env.JWT_REFRESH_SECRET,
  accessExpiry: '15m',    // Short-lived
  refreshExpiry: '7d',    // Longer-lived
  algorithm: 'HS256',     // Or RS256 for asymmetric
  issuer: 'your-app-name',
  audience: 'your-app-users'
};

function generateAccessToken(user) {
  const payload = {
    sub: user.id,           // Subject (user ID)
    email: user.email,      // Only non-sensitive data
    role: user.role,
    // Don't include: password, SSN, credit card, etc.
  };

  return jwt.sign(payload, JWT_CONFIG.accessSecret, {
    algorithm: JWT_CONFIG.algorithm,
    expiresIn: JWT_CONFIG.accessExpiry,
    issuer: JWT_CONFIG.issuer,
    audience: JWT_CONFIG.audience,
    jwtid: crypto.randomUUID()  // Unique token ID
  });
}

function generateRefreshToken(user) {
  const payload = {
    sub: user.id,
    type: 'refresh',
    family: crypto.randomUUID()  // For refresh token rotation
  };

  return jwt.sign(payload, JWT_CONFIG.refreshSecret, {
    algorithm: JWT_CONFIG.algorithm,
    expiresIn: JWT_CONFIG.refreshExpiry,
    issuer: JWT_CONFIG.issuer
  });
}

2. Token Verification (CRITICAL)