Token-Based Authentication with Cookies and JWT Expiration

Introduction

Welcome to the lesson on Token-Based Authentication with Cookies and JWT Expiration . In our previous lesson, we explored account lockout and enumeration prevention, which are crucial for securing web applications. Today, we'll dive deeper into token-based authentication, a key component in modern application security. We'll focus on advanced features like the usage of cookies and token expiration. These concepts are essential for maintaining secure and efficient authentication processes in your applications. Let's get started! 🚀

Securing JSON Web Tokens (JWT)

In the previous unit, we focused on only one authentication method: using user credentials, specifically username and password. You already know that JSON Web Tokens (JWT) are commonly used for secure authentication. However, as more resources gain access to an account, the number of potential attack vectors increases. What happens if JWTs are exposed? Here, we present strategies to enhance the security of JWTs.

Limiting Damage from Token Theft

In previous courses, we mainly focused on how attackers can exploit vulnerabilities. However, ensuring security in applications not only includes mitigating the chances of an outage but also focuses on reducing the harm when a breach has already occurred. Imagine that the attacker somehow stole your JWT token (one example is that the engineer posted unnecessary debug results including this data in an online Q&A platform). One way to limit the attacker's actions is to implement a token expiration mechanism.

Implementing Token Expiration

Before this, you may have noticed that we used the following structure to create the token in the '/login' api: TypeScriptconst token = jwt.sign({ userId: user.id }, JWT_SECRET_KEY); As we discussed earlier, this is vulnerable. Token expiration is a critical feature that ensures tokens are valid only for a limited time, reducing the risk of misuse. TypeScriptconst token = jwt.sign( { userId: user.id }, JWT_SECRET_KEY, { expiresIn: '1h' } // The 'expiresIn' option is part of the jwt.sign method ); Here, we set the expiresIn option to 1h, meaning the token will expire in one hour. This limits the window of opportunity for an attacker to use a stolen token.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Implementing Token Handling with Cookies

Here's how you can implement token handling using cookies in an Express application:

TypeScript

import express from 'express';
import jwt from 'jsonwebtoken';
import { v4 as uuidv4 } from 'uuid';
import { JWT_SECRET_KEY } from '../../config';

const app = express();
app.use(express.json());

// Token generation with proper claims
function generateAccessToken(userId: string) {
  return jwt.sign(
    { 
      userId
    },
    JWT_SECRET_KEY,
    { 
      expiresIn: '15m'  // Short-lived
    }
  );
}

// Login endpoint
app.post('/api/auth/login', async (req, res) => {
  const { username, password } = req.body;
  
  // Authentication logic (not shown)
  const user = { id: '123', username: 'user' }; // Mock user
  
  // Generate access token
  const accessToken = generateAccessToken(user.id);
  
  // Set access token in HTTP-only cookie
  res.cookie('access_token', accessToken, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    maxAge: 15 * 60 * 1000 // 15 minutes
  });
  
  res.json({ success: true });
});

import express from 'express';
import jwt from 'jsonwebtoken';
import { v4 as uuidv4 } from 'uuid';
import { JWT_SECRET_KEY } from '../../config';

const app = express();
app.use(express.json());

// Token generation with proper claims
function generateAccessToken(userId: string) {
  return jwt.sign(
    { 
      userId
    },
    JWT_SECRET_KEY,
    { 
      expiresIn: '15m'  // Short-lived
    }
  );
}

// Login endpoint
app.post('/api/auth/login', async (req, res) => {
  const { username, password } = req.body;
  
  // Authentication logic (not shown)
  const user = { id: '123', username: 'user' }; // Mock user
  
  // Generate access token
  const accessToken = generateAccessToken(user.id);
  
  // Set access token in HTTP-only cookie
  res.cookie('access_token', accessToken, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    maxAge: 15 * 60 * 1000 // 15 minutes
  });
  
  res.json({ success: true });
});

Introduction

Securing JSON Web Tokens (JWT)

Limiting Damage from Token Theft

Implementing Token Expiration

Join the 1M+ learners on CodeSignal

The Problem with Returning JWT Tokens via `res.json`

What are Cookies and How Can They Be Used?

Implementing Token Handling with Cookies

Explanation:

Handling Cookies in the Frontend

Including Cookies in Requests

Handling Authentication State

Real-World Applications and Security Challenges

Conclusion and Next Steps