jwt-auth

JWT authentication in a MERN stack application is implemented by generating access and refresh tokens, storing refresh tokens in httpOnly cookies, and rotating tokens upon use. This Skill provides the complete flow from registration to secure server-side logout.

Refresh token rotation in JWT auth issues a new refresh token with each access token request, while reuse detection invalidates the session if a previously rotated token is reused. This approach prevents token theft and secures user sessions in MERN applications.

Securely store JWTs in React and Node.js by placing refresh tokens in httpOnly cookies to prevent JavaScript access, and using short-lived access tokens. This Skill implements that pattern with bcrypt for password hashing and SHA-256 for refresh token hashing.

Yes, this JWT auth implementation handles server-side logout by invalidating the stored refresh token. It ensures that even if the httpOnly cookie is compromised, the refresh token cannot be reused to generate new access tokens after the user logs out.

The best way to hash passwords in a MERN stack application is using bcrypt for secure salted hashing. This Skill incorporates bcrypt for password storage alongside SHA-256 for refresh token hashing to ensure robust authentication security.

Your JWT refresh token gets invalidated after one use because of refresh token rotation, a security mechanism that issues a new token pair upon each refresh. This prevents replay attacks by detecting token reuse and invalidating the compromised session.