skills.rest
Ryanzucchi
RyanzucchiCOMMUNITY
Explore all skills by this author →
GitHub

autenticacao-jwt-e-refresh-token

Implements stateless JWT authentication with rotating refresh tokens in HTTPOnly cookies.

Updated Jul 19, 2026
Search Tags:#authentication#jwt#token rotation#rs256#session security#refresh token#httponly cookie
One-click install
npx skills add https://github.com/Ryanzucchi/Eldritch_Lich --skill autenticacao-jwt-e-refresh-token-ryanzucchi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: autenticacao-jwt-e-refresh-token
Source: https://github.com/Ryanzucchi/Eldritch_Lich/tree/main/.agents/skills/autenticacao-jwt-e-refresh-token
Command: npx skills add https://github.com/Ryanzucchi/Eldritch_Lich --skill autenticacao-jwt-e-refresh-token-ryanzucchi

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jsonwebtoken, python-jose.

What problem does it solve? Building a secure login system from scratch is error-prone: tokens stored in localStorage get stolen via XSS, refresh tokens without rotation allow indefinite session hijacking, and missing theft detection leaves compromised sessions invisible. This Skill provides a complete, security-hardened specification for stateless authentication with short-lived JWT access tokens and rotating refresh tokens. ## Core Features & Use Cases - Token Pair Generation: Issues 15-minute RS256-signed JWT access tokens alongside 30-day refresh tokens stored as SHA-256 hashes in the database. - Refresh Token Rotation with Theft Detection: Rotates tokens on every refresh and revokes the entire token family when reuse of a rotated token is detected. - Secure Cookie Handling: Delivers refresh tokens exclusively via HttpOnly, Secure, SameSite=Strict cookies scoped to the refresh endpoint. - Use Case: When implementing the login, logout, and social OAuth flow (Google, GitHub) for a multi-tenant SaaS platform, follow this Skill to get a complete step-by-step process, configuration table, and validation checklist. ## Quick Start Implement the login and token refresh flow for the platform following the JWT and rotating refresh token specification, including family revocation on token reuse.

Frequently Asked Questions about autenticacao-jwt-e-refresh-token

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT refresh token rotation securely?▼

Store only the SHA-256 hash of each refresh token in the database with a family_id, then revoke the used token and issue a new pair on every refresh. If a rotated token is presented again, revoke the entire family to force re-authentication.

How to detect refresh token theft in a Node.js API?▼

Detect theft by tracking token reuse: when a refresh token that was already rotated is presented again, treat it as compromise. Revoke all tokens sharing the same family_id so both attacker and legitimate user sessions are terminated.

Should refresh tokens be stored in localStorage or HTTPOnly cookies?▼

Refresh tokens must be stored exclusively in HTTPOnly, Secure, SameSite=Strict cookies, never in localStorage. localStorage is readable by any JavaScript on the page, exposing tokens to XSS theft, while HTTPOnly cookies are inaccessible to scripts.

What JWT algorithm and expiration should access tokens use?▼

Use RS256 asymmetric signing so services verify tokens with a public key while only the auth server holds the private key. Set access token expiration to 15 minutes to limit the window of exposure if a token leaks.

When should I not use this JWT authentication approach?▼

Do not use this Skill for per-resource permission control, which belongs to an RBAC authorization layer, or for encrypting data at rest, which is infrastructure scope. It covers only the authentication and session lifecycle.

Related Skills

Explore More Software Engineering Skills→
salvo-rssalvo-rs
20

salvo-tls-acme

Automates ACME certificate provisioning and renewal for Rust Salvo apps via Rustls and HTTP-01/TLS-ALPN-01 challenges.

Official
Advanced
omakeiomakei
2

adonisjs-routing

Organize AdonisJS routes with middleware and Bouncer authorization patterns.

Community
Advanced
thesaifalitaithesaifalitai
8

auth-patterns

Implement authentication and authorization with NextAuth.js, Prisma, and RBAC.

Community
Advanced
igbuendigbuend
8

opaque-token-based-authentication-pattern

Implement server-side opaque token authentication with CSPRNG generation and lifecycle policies.

Community
Advanced