JWT Authentication — Animate | AI Wisdom

← Back to topic
🎞 ANIMATE · Mode 3 of 5 · +100 XP— JWT Authentication
🎫Issue Token
📡Transmit
✅Validate
🔄Refresh
🎯 Next: Test →
Step 1 / 4
Speed
Issue Access Token
Sign JWT with RS256 + Required Claims💡 Analogy
Like a notarised letter — anyone can verify the notary's stamp, but only the notary can create it.
The auth server signs a JWT with a private key. The token includes issuer, audience, and a 15-minute expiry.
Console Output
> jwt.sign({sub: 'user-123', email: 'alice@app.com', roles: ['user']})
> Algorithm: RS256 (asymmetric — public key can verify)
> Claims: iss=auth.myapp.com, aud=api.myapp.com, exp=+15min
> Token: eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyLTEyMyJ9.<sig>
●jwt-auth.ts
Issue Access TokenL19–26
1// JWT Authentication — Secure Implementation
2import jwt from 'jsonwebtoken';
3import { createClient } from 'redis';
4 
5const ACCESS_SECRET  = process.env.JWT_ACCESS_SECRET!;   // RS256 private key
6const REFRESH_SECRET = process.env.JWT_REFRESH_SECRET!;
7const ACCESS_TTL  = '15m';
8const REFRESH_TTL = '7d';
9 
10const redis = createClient({ url: process.env.REDIS_URL });
11 
12// ─── ISSUE TOKENS ────────────────────────────────
13interface TokenPayload {
14  sub: string;   // user ID
15  email: string;
16  roles: string[];
17}
18 
19function issueAccessToken(payload: TokenPayload): string {
20  return jwt.sign(payload, ACCESS_SECRET, {
21    algorithm: 'RS256',
22    expiresIn: ACCESS_TTL,
23    issuer: 'auth.myapp.com',
24    audience: 'api.myapp.com',
25  });
26}
27 
28function issueRefreshToken(userId: string): string {
29  return jwt.sign({ sub: userId }, REFRESH_SECRET, {
30    algorithm: 'HS256',
31    expiresIn: REFRESH_TTL,
32  });
33}
34 
35// ─── VALIDATE ACCESS TOKEN ───────────────────────
36async function validateAccessToken(token: string): Promise<TokenPayload> {
37  // Check blocklist first (revoked tokens)
38  const isRevoked = await redis.get(`blocklist:${token}`);
39  if (isRevoked) throw new Error('Token revoked');
40 
41  const payload = jwt.verify(token, ACCESS_SECRET, {
42    algorithms: ['RS256'],           // Whitelist — never trust alg from header
43    issuer: 'auth.myapp.com',
44    audience: 'api.myapp.com',
45  }) as TokenPayload;
46 
47  return payload;
48}
49 
50// ─── REFRESH TOKEN ROTATION ──────────────────────
51async function refreshTokens(refreshToken: string) {
52  // Verify the refresh token
53  const decoded = jwt.verify(refreshToken, REFRESH_SECRET) as { sub: string };
54 
55  // Rotate: invalidate old, issue new
56  await redis.setEx(`blocklist:refresh:${refreshToken}`, 60 * 60 * 24 * 7, '1');
57 
58  const newAccessToken  = issueAccessToken({ sub: decoded.sub, email: '', roles: [] });
59  const newRefreshToken = issueRefreshToken(decoded.sub);
60 
61  return { accessToken: newAccessToken, refreshToken: newRefreshToken };
62}
63 
63 lines
Timeline — 4 Steps
Issue Access Token
Sign JWT with RS256 + Required Claims💡 Analogy
Like a notarised letter — anyone can verify the notary's stamp, but only the notary can create it.
The auth server signs a JWT with a private key. The token includes issuer, audience, and a 15-minute expiry.
Console Output
> jwt.sign({sub: 'user-123', email: 'alice@app.com', roles: ['user']})
> Algorithm: RS256 (asymmetric — public key can verify)
> Claims: iss=auth.myapp.com, aud=api.myapp.com, exp=+15min
> Token: eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyLTEyMyJ9.<sig>

Was this page helpful?

Discussion

Sign JWT with RS256 + Required Claims

💡 Analogy

Like a notarised letter — anyone can verify the notary's stamp, but only the notary can create it.

The auth server signs a JWT with a private key. The token includes issuer, audience, and a 15-minute expiry.

Console Output

> jwt.sign({sub: 'user-123', email: 'alice@app.com', roles: ['user']})
> Algorithm: RS256 (asymmetric — public key can verify)
> Claims: iss=auth.myapp.com, aud=api.myapp.com, exp=+15min
> Token: eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyLTEyMyJ9.<sig>

Sign JWT with RS256 + Required Claims

💡 Analogy

Like a notarised letter — anyone can verify the notary's stamp, but only the notary can create it.

The auth server signs a JWT with a private key. The token includes issuer, audience, and a 15-minute expiry.

Console Output

> jwt.sign({sub: 'user-123', email: 'alice@app.com', roles: ['user']})
> Algorithm: RS256 (asymmetric — public key can verify)
> Claims: iss=auth.myapp.com, aud=api.myapp.com, exp=+15min
> Token: eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyLTEyMyJ9.<sig>