hjemmesidekongen/auth-patterns

Auth Patterns

Auth is where structural mistakes matter more than implementation bugs. Wrong token storage, no rotation, or missing expiry creates permanent exposure.

OAuth 2.0 Flow Selection

Authorization Code + PKCE — SPAs, mobile apps. No client secret. PKCE replaces it with a one-time code verifier. Default choice for anything running in a browser.

Authorization Code (confidential) — server-side apps with a securely stored client secret. Secret never leaves the server.

Client Credentials — machine-to-machine, no user. Short-lived tokens rotated by infra.

Device Flow — TVs, CLIs, limited-input devices. User completes auth on a secondary device.

JWT Essentials

Signed (not encrypted) — the payload is readable. Required claims: iss, sub, aud, exp, iat, jti. Validation must verify signature, exp, iss, and aud — libraries skip aud by default, configure it explicitly.

Signing: use RS256 or ES256 for distributed systems. HS256 requires all services to share the secret — rotation becomes an operational risk.

Refresh Token Rotation

Short-lived access tokens (15m) + longer-lived refresh tokens (7–30d). On refresh: invalidate the old token, issue a new one. Reuse of an invalidated token signals theft — invalidate the entire token family. Store refresh tokens as hashed values, not plaintext.

Session-Based Auth

httpOnly, Secure, SameSite cookie with a session ID. Session data server-side — Redis as the backing store. Prefer this over JWT when instant revocation is required (ban, logout-all-devices). Session IDs: 128-bit random, never derived from user data.

RBAC and ABAC

RBAC: roles → permissions. Works well up to ~20 permission types. Define roles in code unless dynamic creation is a product requirement. Encode roles in the JWT roles claim for stateless checks.

ABAC: policies evaluate attributes (user, resource, context). Use for complex multi-tenant or enterprise access models.

Anti-Patterns and Reference

JWT in localStorage, missing exp, HS256 in microservices, rolling your own crypto, plaintext passwords, trusting alg: none. See references/process.md for PKCE flow, JWT validation middleware, NextAuth config, RBAC middleware, argon2id hashing, and TOTP setup.