auth-implementation-patterns

Sign a short-lived access token with jsonwebtoken containing userId, email, and role claims, then verify it in middleware that reads the Bearer token from the Authorization header. Attach the decoded payload to the request object for downstream route handlers.

Store a hashed refresh token in the database with an expiration date, then verify it on refresh requests before issuing a new access token. Revoke tokens by deleting them on logout, or delete all user tokens to log out every device.

Sessions store state server-side (e.g., in Redis) and suit traditional apps with cookie-based clients, while JWT is stateless and scales horizontally across services. OAuth2 via Passport.js is the right choice when delegating login to Google or GitHub.

Define a role hierarchy mapping each role to the roles it inherits, then write middleware that checks the authenticated user's role against required roles and returns 403 when permissions are insufficient. Permission-based checks and resource ownership validation extend this for finer control.

localStorage is accessible to any JavaScript on the page, so an XSS vulnerability lets attackers steal tokens. Use httpOnly, secure, sameSite cookies instead so tokens are never exposed to client-side scripts.

Use express-rate-limit with a Redis store to cap login attempts, for example 5 tries per 15 minutes per client. Apply a separate, higher limit to general API routes so normal traffic is unaffected.