What problem does it solve? Building secure authentication in Node.js and Express apps is error-prone: tokens get stolen via XSS, refresh flows leak credentials, and login endpoints get hammered by brute-force attacks. This Skill provides production-grade patterns for the full JWT token lifecycle so you avoid these common security pitfalls. ## Core Features & Use Cases - Access/Refresh Token Rotation: Short-lived JWT access tokens paired with long-lived refresh tokens stored in HttpOnly, SameSite, Secure cookies. - Passport JWT Integration: Cookie-and-header token extraction with a Passport JWT strategy and reusable requireAuth middleware for protecting Express routes. - Credential & Endpoint Hardening: bcrypt password hashing, Mongoose toJSON transforms that strip passwords, and express-rate-limit on auth endpoints to stop brute-force attacks. - Use Case: You are adding login and session management to a React + Express app. Use this Skill to configure secure cookies, wire up Passport JWT, hash passwords with bcrypt, and rate-limit the login route before shipping. ## Quick Start Use the jwt-auth-security skill to implement secure login with refresh token rotation and HttpOnly cookies in my Express TypeScript API.
