Secure Authentication Patterns

JWT Implementation

• Access token: short-lived (15 min)
• Refresh token: long-lived (7 days), stored in httpOnly cookie
• Always validate: expiry, issuer, audience
• Never store JWT in localStorage (XSS vulnerable)
• Rotate refresh tokens on each use

Password Security

• Hash with bcrypt (cost factor 12+)
• Minimum 8 characters, require complexity
• Rate limit login attempts (5 per minute)
• Account lockout after 10 failed attempts
• Never log passwords, even hashed