authentication-skill

Secure user authentication uses bcrypt for password hashing and JWT for stateless token generation. This workflow validates login parameters, checks user status, and issues JWT tokens to manage sessions without server-side storage.

Adding CAPTCHA and rate limiting to login endpoints prevents automated brute-force attacks. The authentication workflow supports configurable production CAPTCHA verification and throttles login attempts to secure the validation process.

Protecting API routes with JWT middleware involves intercepting requests to validate the provided token. The workflow includes a middleware example that verifies JWT signatures and expiration before allowing access to protected endpoints.

Yes, Google 2FA integrates into existing password login flows as an optional security layer. The authentication workflow supports optional two-factor authentication alongside core password verification and JWT token generation.

Token-based session management issues a JWT upon successful login validation and password verification. The server validates this token on subsequent requests via middleware, handling expiration and ensuring secure API access.

Yes, the login validation process explicitly includes user status checks. Before completing password verification with bcrypt and issuing JWT tokens, the workflow verifies the user account is active and valid.