How does this skill handle password security?

The implementation uses bcrypt with a work factor of 12 to hash passwords before they are stored in the database, following industry standards for protecting user credentials.

Where are the refresh tokens stored?

Refresh tokens are stored as SHA-256 hashes in the database for session management and sent to the client via secure, httpOnly cookies to prevent access by malicious JavaScript.

What happens when an access token expires?

The included Axios interceptors automatically detect 401 errors, trigger a silent refresh request to obtain a new token pair, and retry the original request without user intervention.

How does token rotation protect my app?

Every time a refresh token is used, it is invalidated and replaced with a new one. If an old token is reused, the system detects a potential attack and revokes all active sessions for that user.

JWT Auth for MERN Stack

Name: JWT Auth for MERN Stack
Author: chavangorakh1999

bychavangorakh1999

0•

API開発

Implements production-grade JWT authentication with token rotation and httpOnly cookies for MERN stack applications.

This skill provides a comprehensive authentication blueprint for MERN (MongoDB, Express, React, Node.js) applications that prioritizes security and developer experience. It automates the implementation of the full JWT lifecycle, including secure registration, login with bcrypt hashing, and a robust refresh token rotation strategy. By using httpOnly cookies for refresh tokens and providing pre-configured Axios interceptors for the frontend, it ensures your application follows industry best practices to mitigate XSS and token reuse attacks while maintaining a seamless user experience through silent refresh logic.

主な機能

01Integrated Axios interceptors for automated token management

020 GitHub stars

03Bcrypt password hashing with a work factor of 12

04Secure access and refresh token pair system

05httpOnly cookie storage for XSS protection

06Automatic refresh token rotation and reuse detection

ユースケース

01Implementing persistent login states with secure silent refresh logic

02Upgrading legacy session-based auth to a modern JWT-based architecture

03Setting up a secure user management system for a new MERN application

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add chavangorakh1999/sde-skills jwt-auth

For use in Claude.ai and ChatGPT

主な機能

01Integrated Axios interceptors for automated token management

020 GitHub stars

03Bcrypt password hashing with a work factor of 12

04Secure access and refresh token pair system

05httpOnly cookie storage for XSS protection

06Automatic refresh token rotation and reuse detection

ユースケース

01Implementing persistent login states with secure silent refresh logic

02Upgrading legacy session-based auth to a modern JWT-based architecture

03Setting up a secure user management system for a new MERN application

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add chavangorakh1999/sde-skills jwt-auth

For use in Claude.ai and ChatGPT