Token-Based Authentication with Cookies and JWT Expiration

Introduction

Welcome to the lesson on Token-Based Authentication with Cookies and JWT Expiration . In our previous lesson, we explored account lockout and enumeration prevention, which are crucial for securing web applications. Today, we'll dive deeper into token-based authentication, a key component in modern application security. We'll focus on advanced features like the usage of cookies and token expiration. These concepts are essential for maintaining secure and efficient authentication processes in your applications. Let's get started!

Securing JSON Web Tokens (JWT)

In the previous unit, we focused on only one authentication method: using user credentials, specifically username and password. You already know that JSON Web Tokens (JWT) are commonly used for secure authentication. However, as more resources gain access to an account, the number of potential attack vectors increases. What happens if JWTs are exposed? Here, we present strategies to enhance the security of JWTs.

Limiting Damage from Token Theft

In previous courses, we mainly focused on how attackers can exploit vulnerabilities. However, ensuring security in applications not only includes mitigating the chances of an outage but also focuses on reducing the harm when a breach has already occurred. Imagine that the attacker somehow stole your JWT token (one example is that the engineer posted unnecessary debug results including this data in an online Q&A platform). One way to limit the attacker's actions is to implement a token expiration mechanism.

Implementing Token Expiration

Before this, you may have noticed that we used the following structure to create the token in the '/login' api: Pythontoken = jwt.encode({'userId': user.id}, JWT_SECRET_KEY, algorithm='HS256') As we discussed earlier, this is vulnerable. Token expiration is a critical feature that ensures tokens are valid only for a limited time, reducing the risk of misuse. Pythonfrom datetime import datetime, timedelta # Generate token with expiration token = jwt.encode( { 'userId': user.id, 'exp': datetime.utcnow() + timedelta(hours=1) # Token expires in 1 hour }, JWT_SECRET_KEY, algorithm='HS256' )from datetime import datetime, timedelta # Generate token with expiration token = jwt.encode( { 'userId': user.id, 'exp': datetime.utcnow() + timedelta(hours=1) # Token expires in 1 hour }, JWT_SECRET_KEY, algorithm='HS256' ) Here, we set the exp claim to expire in one hour. This limits the window of opportunity for an attacker to use a stolen token.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Python

from datetime import datetime, timedelta

# Generate token with expiration
token = jwt.encode(
    {
        'userId': user.id,
        'exp': datetime.utcnow() + timedelta(hours=1)  # Token expires in 1 hour
    },
    JWT_SECRET_KEY,
    algorithm='HS256'
)

Python

from fastapi import FastAPI, HTTPException, Response, Request
from jose import jwt
from datetime import datetime, timedelta
from ..config import JWT_SECRET_KEY

app = FastAPI()

# Token generation with proper claims
def generate_access_token(user_id: int):
    return jwt.encode(
        {
            'userId': user_id,
            'exp': datetime.utcnow() + timedelta(minutes=15)  # Short-lived
        },
        JWT_SECRET_KEY,
        algorithm='HS256'
    )

# Login endpoint
@app.post('/api/auth/login')
async def login(request: Request, response: Response):
    data = await request.json()
    username = data.get('username')
    password = data.get('password')
    
    # Authentication logic (not shown)
    user = {"id": 123, "username": "user"}  # Mock user
    
    # Generate access token
    access_token = generate_access_token(user["id"])
    
    # Set access token in HTTP-only cookie
    response.set_cookie(
        key="access_token",
        value=access_token,
        httponly=True,
        secure=True,
        samesite="strict",
        max_age=15 * 60  # 15 minutes
    )
    
    return {"success": True}

from fastapi import FastAPI, HTTPException, Response, Request
from jose import jwt
from datetime import datetime, timedelta
from ..config import JWT_SECRET_KEY

app = FastAPI()

# Token generation with proper claims
def generate_access_token(user_id: int):
    return jwt.encode(
        {
            'userId': user_id,
            'exp': datetime.utcnow() + timedelta(minutes=15)  # Short-lived
        },
        JWT_SECRET_KEY,
        algorithm='HS256'
    )

# Login endpoint
@app.post('/api/auth/login')
async def login(request: Request, response: Response):
    data = await request.json()
    username = data.get('username')
    password = data.get('password')
    
    # Authentication logic (not shown)
    user = {"id": 123, "username": "user"}  # Mock user
    
    # Generate access token
    access_token = generate_access_token(user["id"])
    
    # Set access token in HTTP-only cookie
    response.set_cookie(
        key="access_token",
        value=access_token,
        httponly=True,
        secure=True,
        samesite="strict",
        max_age=15 * 60  # 15 minutes
    )
    
    return {"success": True}

JavaScript

const response = await fetch(API_ENDPOINTS.LOGIN, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ username, password }),
  credentials: 'include' // Ensures cookies are sent with the request
});

const response = await fetch(API_ENDPOINTS.LOGIN, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ username, password }),
  credentials: 'include' // Ensures cookies are sent with the request
});

JavaScript

if (response.ok) {
  onLogin({ username });
  navigate("/");
} else {
  setError('Invalid credentials');
}

if (response.ok) {
  onLogin({ username });
  navigate("/");
} else {
  setError('Invalid credentials');
}

Python

from fastapi import Request, HTTPException
from jose import jwt, JWTError
from ..config import JWT_SECRET_KEY

async def get_current_user_from_cookie(request: Request):
    """Get current user from cookie"""
    token = request.cookies.get('access_token')
    
    if not token:
        raise HTTPException(status_code=401, detail="Authentication required")
    
    try:
        decoded = jwt.decode(token, JWT_SECRET_KEY, algorithms=['HS256'])
        user_id = decoded['userId']
        return {"id": user_id}
    except JWTError:
        raise HTTPException(status_code=401, detail="Invalid token")

from fastapi import Request, HTTPException
from jose import jwt, JWTError
from ..config import JWT_SECRET_KEY

async def get_current_user_from_cookie(request: Request):
    """Get current user from cookie"""
    token = request.cookies.get('access_token')
    
    if not token:
        raise HTTPException(status_code=401, detail="Authentication required")
    
    try:
        decoded = jwt.decode(token, JWT_SECRET_KEY, algorithms=['HS256'])
        user_id = decoded['userId']
        return {"id": user_id}
    except JWTError:
        raise HTTPException(status_code=401, detail="Invalid token")

Python

from fastapi import FastAPI, HTTPException, Response, Request
from jose import jwt
from datetime import datetime, timedelta
from ..config import JWT_SECRET_KEY

app = FastAPI()

# Token generation with proper claims
def generate_access_token(user_id: int):
    return jwt.encode(
        {
            'userId': user_id,
            'exp': datetime.utcnow() + timedelta(minutes=15)  # Short-lived
        },
        JWT_SECRET_KEY,
        algorithm='HS256'
    )

# Login endpoint
@app.post('/api/auth/login')
async def login(request: Request, response: Response):
    data = await request.json()
    username = data.get('username')
    password = data.get('password')
    
    # Authentication logic (not shown)
    user = {"id": 123, "username": "user"}  # Mock user
    
    # Generate access token
    access_token = generate_access_token(user["id"])
    
    # Set access token in HTTP-only cookie
    response.set_cookie(
        key="access_token",
        value=access_token,
        httponly=True,
        secure=True,
        samesite="strict",
        max_age=15 * 60  # 15 minutes
    )
    
    return {"success": True}

JavaScript

const response = await fetch(API_ENDPOINTS.LOGIN, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ username, password }),
  credentials: 'include' // Ensures cookies are sent with the request
});

JavaScript

if (response.ok) {
  onLogin({ username });
  navigate("/");
} else {
  setError('Invalid credentials');
}

Python

from fastapi import Request, HTTPException
from jose import jwt, JWTError
from ..config import JWT_SECRET_KEY

async def get_current_user_from_cookie(request: Request):
    """Get current user from cookie"""
    token = request.cookies.get('access_token')
    
    if not token:
        raise HTTPException(status_code=401, detail="Authentication required")
    
    try:
        decoded = jwt.decode(token, JWT_SECRET_KEY, algorithms=['HS256'])
        user_id = decoded['userId']
        return {"id": user_id}
    except JWTError:
        raise HTTPException(status_code=401, detail="Invalid token")

Introduction

Securing JSON Web Tokens (JWT)

Limiting Damage from Token Theft

Implementing Token Expiration

Join the 1M+ learners on CodeSignal

The Problem with Returning JWT Tokens via JSON Response

What are Cookies and How Can They Be Used?

Implementing Token Handling with Cookies in FastAPI

Explanation:

Handling Cookies in the Frontend

Including Cookies in Requests

Handling Authentication State

Reading Cookies in FastAPI

Real-World Applications and Security Challenges

Conclusion and Next Steps