security-auth

JWT authentication with refresh token rotation is implemented by issuing short-lived access tokens alongside refresh tokens, ensuring secure session management across web apps and APIs. The pattern includes password hashing and token rotation to prevent session hijacking.

RBAC and ABAC authorization patterns across microservices are implemented by defining role-based access control and attribute-based policies to restrict user actions. This approach applies secure guardrails to prevent common security anti-patterns in distributed architectures.

OAuth2 and OIDC integration for social login and SSO works by connecting external identity providers to issue standardized tokens, enabling single sign-on across services. This integration handles standard session management and secure credential delegation.

MFA and secure session management are supported for high-security APIs requiring multi-factor authentication. The implementation applies to web apps, APIs, and microservices, adding layered verification steps and token protection for sensitive scenarios.

Security guardrails to avoid common authentication anti-patterns include secure credential handling, password hashing best practices, and short-lived token enforcement. These measures prevent vulnerable session configurations and improper access control implementations.

You need OAuth2/OIDC instead of standard JWT token management when implementing social login, single sign-on, or delegating authentication to external identity providers. Standard JWT token management is sufficient for internal user stores without SSO requirements.