jwt-auth

JWT-based authentication issues short-lived access tokens and uses refresh token rotation to maintain secure, stateless user sessions across web APIs. This approach pairs bcrypt password hashing with token validation to prevent unauthorized access.

Bcrypt password hashing secures user credentials during registration and login by applying a salted hash to plaintext passwords before storage. The authentication flow then verifies the provided password against the stored bcrypt hash during login.

JWT authentication applies rate-limiting to login, registration, and password reset flows to prevent brute-force attacks and abuse. Rate limits are integrated directly into the token issuance and validation services to enforce security best practices.

Creating and revoking JWT tokens for password reset workflows involves generating signed, short-lived verification tokens and revoking them upon successful password update. This ensures only valid recipients can trigger the reset process.

JWT access and refresh tokens enable stateless authentication across multiple web applications by encoding user identity within signed tokens. The server validates the token signature without storing session state, allowing scalable and secure API access.

Refresh token rotation invalidates active user sessions when a previously used refresh token is detected during validation, indicating potential token reuse or theft. Revoking the token family immediately secures the account against session hijacking.