auth_patterns

Sign a short-lived access token with jsonwebtoken containing the user ID and role, then verify it in middleware that reads the Bearer token from the Authorization header. Attach the decoded payload to the request object for downstream route handlers.

Use JWT for SPAs, mobile apps, and horizontally scaled services since tokens are stateless. Use server-side sessions with Redis storage for traditional server-rendered apps where simple revocation and cookie-based transport matter more.

Configure the GoogleStrategy with your client ID, secret, and callback URL, then find or create a user from the OAuth profile in the verify callback. After successful authentication, issue your own JWT and redirect the user to the frontend with the token.

Avoid localStorage because it is vulnerable to XSS attacks that can steal tokens. Prefer httpOnly, secure, sameSite cookies so JavaScript cannot access the token and CSRF risk is reduced.

Define a role hierarchy mapping each role to the roles it inherits, then write middleware that checks the authenticated user's role against required roles. Return 403 when the user's role lacks the required permission.

Without rate limiting, attackers can attempt unlimited password guesses. Apply express-rate-limit with a Redis store to restrict login attempts, for example 5 tries per 15 minutes per client.