1. Concept library
  2. Backend with Node.js
  3. Module 7: Authentication

Concept

JWT access tokens

A JWT is a signed set of claims the server issues and later verifies without a lookup. Keep them short-lived, verify the signature and expiry on every request, and put only what the server needs inside.

What a session covers

The tutor works through these with you, in conversation and code. A session ends when you have shown them, not when a video does.

  1. Explain what a JWT contains and what the signature proves
  2. Issue and verify a short-lived token on every request
  3. Spot the verifier that accepts any algorithm, including none

In practice

A few lines that show JWT access tokens doing its job.

JavaScript
import { SignJWT, jwtVerify } from "jose";
const secret = new TextEncoder().encode(process.env.JWT_SECRET);

const token = await new SignJWT({ sub: user.id, role: user.role })
  .setProtectedHeader({ alg: "HS256" })
  .setIssuedAt()
  .setExpirationTime("15m")
  .sign(secret);

const { payload } = await jwtVerify(token, secret, { algorithms: ["HS256"] });

The common mistake

Watch for

Accepting whatever algorithm the token header names, including "none". Pin the algorithms you issue, and never put secrets in the payload: it is only base64, readable by anyone.

What to know first

Your roadmap puts these before JWT access tokens, unless you already know them.

How it stays learned

Once a session shows you understand JWT access tokens, it comes back for review. Each review takes a minute and tells the memory model how well you still know it.

  1. Day 3First recall, while it is fresh
  2. Day 7Second, a week on
  3. Day 18Last, when it has settled

Where it leads

Topics that build on JWT access tokens.

Previous in the module← Sessions versus tokens