authentication-skill

JWT authentication uses short-lived access tokens paired with refresh token rotation to secure APIs. This approach maintains stateless API authentication while allowing token renewal via httpOnly refresh cookies without requiring repeated logins.

OAuth2 social login enables users to sign in with providers like Google and GitHub. Implementing OAuth2 involves configuring multi-provider sign-ins to handle token exchanges and user provisioning across your web app.

Both session-based auth and JWT can coexist in one application. Use session management for traditional server-rendered pages with server-side state, while applying JWT for stateless API authentication across your services.

Role-based access control (RBAC) enforces fine-grained permission checks via middleware. Applying requireAuth and requirePermission middleware to API endpoints ensures only users with specific roles can access protected resources.

Choosing a managed authentication provider like Clerk, Supabase Auth, Auth0, or NextAuth reduces development overhead and provides built-in security. Self-hosting offers more control but requires maintaining token handling, MFA, and OAuth flows yourself.

MFA and passkeys strengthen login security by requiring additional verification factors beyond passwords. Setting up MFA involves configuring multi-step verification flows during login and signup to protect user accounts from unauthorized access.