skill-auth-jwt

To implement JWT authentication, you generate short-lived access tokens and long-lived refresh tokens to secure web APIs. This Skill provides a structured blueprint for token generation, validation, and rotation to prevent common security pitfalls in user sessions.

The best way to handle JWT token rotation is by issuing new refresh tokens after every access token exchange and maintaining a revocation list. This ensures secure microservices communication and invalidates compromised tokens during active user sessions.

Storing JWTs in HttpOnly cookies improves web backend security by preventing client-side JavaScript from accessing the tokens. This mitigates cross-site scripting (XSS) attacks and ensures secure cookie handling for production-grade authentication practices.

Yes, you can use standard JWT libraries to secure mobile backends and user sessions. This Skill requires standard JWT libraries and secret management to handle token validation and rotation effectively across various platforms.

Ad-hoc JWT implementation creates security risks because manual token generation and validation often lack proper rotation and secure storage. Using a structured blueprint reduces these common pitfalls by enforcing production-grade token handling and secret management.