Token Authentication with Cookies

Introduction

Welcome to the lesson on Token-Based Authentication with Cookies and JWT Expiration . In our previous lesson, we explored account lockout and enumeration prevention, which are crucial for securing web applications. Today, we'll dive deeper into token-based authentication, a key component of modern application security. We'll focus on advanced features like the use of cookies and token expiration. These concepts are essential for maintaining secure and efficient authentication processes in your applications. Let's get started! 🚀

Securing JSON Web Tokens (JWT)

In the previous unit, we focused on only one authentication method: using user credentials, specifically username and password . JSON Web Tokens (JWT) are commonly used for secure authentication. However, as more resources gain access to an account, the number of potential attack vectors increases. What happens if JWTs are exposed? Here, we present strategies to enhance the security of JWTs.

Limiting Damage from Token Theft

In previous courses, we mainly focused on how attackers can exploit vulnerabilities. However, ensuring security in applications not only includes mitigating the chances of an outage but also focuses on reducing the harm when a breach has already occurred. Imagine that an attacker somehow stole your JWT token (one example is that an engineer posted unnecessary debug results, including this data, on an online Q&A platform). One way to limit the attacker's actions is to implement a token expiration mechanism.

Implementing Token Expiration

Previously, you may have seen code that creates a token without an expiration time, which is vulnerable. Token expiration is a critical feature that ensures tokens are valid only for a limited time, reducing the risk of misuse. Here is how you can generate a JWT with an expiration time in Java using the jjwt library: Javaimport io.jsonwebtoken.Jwts; import io.jsonwebtoken.SignatureAlgorithm; import java.util.Date; public class JwtUtil { private static final String JWT_SECRET_KEY = "your-secret-key"; // Use a strong secret in production public static String generateToken(String userId) { long expirationMillis = 60 * 60 * 1000; // 1 hour Date now = new Date(); Date expiryDate = new Date(now.getTime() + expirationMillis); return Jwts.builder() .setSubject(userId) .setIssuedAt(now) .setExpiration(expiryDate) .signWith(SignatureAlgorithm.HS256, JWT_SECRET_KEY) .compact(); } } In this example, the token will expire in one hour. This limits the window of opportunity for an attacker to use a stolen token.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Implementing Token Handling with Cookies

Here's how you can implement token handling using cookies in a Spring Boot application. The following example uses a Spring Boot controller to demonstrate setting a JWT in an HTTP-only cookie after a successful login:

Java

import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody LoginRequest request, HttpServletResponse response) {
        String username = request.getUsername();
        String password = request.getPassword();

        // Authentication logic (not shown)
        String userId = "123"; // Mock user ID

        // Generate JWT token with expiration
        String token = JwtUtil.generateToken(userId);

        // Create cookie with security attributes
        Cookie cookie = new Cookie("access_token", token);
        cookie.setHttpOnly(true);
        cookie.setSecure(true); // Only send over HTTPS
        cookie.setPath("/");
        cookie.setMaxAge(15 * 60); // 15 minutes

        // Add cookie to response
        response.addCookie(cookie);

        // For SameSite attribute, you can set it manually in the header:
        response.setHeader("Set-Cookie",
                String.format("access_token=%s; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=%d",
                        token, 15 * 60));

        return ResponseEntity.ok(Map.of("success", true));
    }
}

import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody LoginRequest request, HttpServletResponse response) {
        String username = request.getUsername();
        String password = request.getPassword();

        // Authentication logic (not shown)
        String userId = "123"; // Mock user ID

        // Generate JWT token with expiration
        String token = JwtUtil.generateToken(userId);

        // Create cookie with security attributes
        Cookie cookie = new Cookie("access_token", token);
        cookie.setHttpOnly(true);
        cookie.setSecure(true); // Only send over HTTPS
        cookie.setPath("/");
        cookie.setMaxAge(15 * 60); // 15 minutes

        // Add cookie to response
        response.addCookie(cookie);

        // For SameSite attribute, you can set it manually in the header:
        response.setHeader("Set-Cookie",
                String.format("access_token=%s; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=%d",
                        token, 15 * 60));

        return ResponseEntity.ok(Map.of("success", true));
    }
}

Approaches to Token Revocation

There are several strategies to handle token revocation, each with trade-offs:

Token Blacklisting: Maintain a list of revoked tokens (in Redis or a database) and check against it on each request:

Java

// Example: Simple token blacklist check
public boolean isTokenRevoked(String token) {
    // Check if token exists in blacklist (Redis, database, etc.)
    return blacklistedTokens.contains(token);
}

// Example: Simple token blacklist check
public boolean isTokenRevoked(String token) {
    // Check if token exists in blacklist (Redis, database, etc.)
    return blacklistedTokens.contains(token);
}

Trade-off: Reintroduces state, reducing the stateless benefit of JWTs.

Short-Lived Access Tokens + Refresh Tokens: Use very short-lived access tokens (5-15 minutes) paired with longer-lived refresh tokens. This limits the window of vulnerability:

Java

// Short-lived access token
String accessToken = JWT.create()
    .withExpiresAt(new Date(System.currentTimeMillis() + 15 * 60 * 1000)) // 15 minutes
    .sign(algorithm);

// Short-lived access token
String accessToken = JWT.create()
    .withExpiresAt(new Date(System.currentTimeMillis() + 15 * 60 * 1000)) // 15 minutes
    .sign(algorithm);

When the access token expires, the client uses a refresh token to get a new one. The refresh token can be revoked server-side. We'll explore this pattern in detail in the next unit.

Token Versioning: Include a version number in the token and store the current valid version server-side:

Java

// Token with version
String token = JWT.create()
    .withClaim("userId", userId)
    .withClaim("tokenVersion", user.getTokenVersion())
    .sign(algorithm);

// Validation checks version
public boolean isTokenValid(String token) {
    DecodedJWT decoded = JWT.require(algorithm).build().verify(token);
    int tokenVersion = decoded.getClaim("tokenVersion").asInt();
    int currentVersion = userRepository.findById(userId).getTokenVersion();
    return tokenVersion == currentVersion;
}

// Token with version
String token = JWT.create()
    .withClaim("userId", userId)
    .withClaim("tokenVersion", user.getTokenVersion())
    .sign(algorithm);

// Validation checks version
public boolean isTokenValid(String token) {
    DecodedJWT decoded = JWT.require(algorithm).build().verify(token);
    int tokenVersion = decoded.getClaim("tokenVersion").asInt();
    int currentVersion = userRepository.findById(userId).getTokenVersion();
    return tokenVersion == currentVersion;
}

When you need to revoke all tokens, simply increment the user's token version.

Introduction

Securing JSON Web Tokens (JWT)

Limiting Damage from Token Theft

Implementing Token Expiration

Join the 1M+ learners on CodeSignal

The Problem with Returning JWT Tokens in the Response Body

What are Cookies and How Can They Be Used?

Implementing Token Handling with Cookies

Explanation:

Handling Cookies in the Frontend

Token Revocation Challenges and Solutions

Approaches to Token Revocation

Practical Considerations

Including Cookies in Requests

Handling Authentication State

Real-World Applications and Security Challenges

Conclusion and Next Steps