auth-implementation-patterns

Sign a short-lived access token with jsonwebtoken containing the user ID, email, and role, then verify it in middleware that reads the Bearer token from the Authorization header. Attach the decoded payload to the request object for downstream route handlers.

Issue a long-lived refresh token alongside the access token, store a hashed copy in the database with an expiration date, and exchange it for a new access token when the old one expires. Revoke stored tokens on logout to invalidate sessions.

Sessions store state server-side and suit traditional web apps with cookies, while JWTs are stateless and scale horizontally across services. The Skill covers both patterns, including Redis-backed Express sessions and token-based flows.

Configure the GoogleStrategy with your client ID, secret, and callback URL, then find or create a user from the OAuth profile in the verify callback. After successful authentication, issue your own JWT and redirect to the frontend.

Tokens in localStorage are accessible to any JavaScript running on the page, making them vulnerable to XSS theft. Use httpOnly, secure, sameSite cookies instead so the browser protects the credential from script access.

Define a role hierarchy mapping each role to the roles it includes, then write middleware that checks the authenticated user's role against the required roles. Return 403 when the user's role lacks sufficient permissions.