Backend7 min read

Authentication & OAuth

Implement secure authentication - JWT tokens, OAuth 2.0 flows, session management, refresh tokens, and common vulnerabilities to avoid.

OAuthJWTAuthenticationSecurityNextAuth

skill: Authentication & OAuth category: Backend tags: [OAuth, JWT, Authentication, Security, NextAuth] readingTime: 7

Don't build authentication from scratch - use a proven library (NextAuth.js, Auth.js, Clerk, Supabase Auth, Auth0) for anything beyond simple API key auth. Auth bugs are silent, severe, and embarrassing. When you do implement JWT or OAuth flows, understand them deeply - a misconfigured redirect_uri or unsigned JWT is a critical vulnerability.

Workflow

Understand JWT structureJWTs are the most misunderstood auth primitive. Understanding their structure prevents common mistakes like trusting unsigned tokens or storing sensitive data in them.
Implement OAuth 2.0 authorization code flow with PKCEThe authorization code flow is the secure way to get tokens from an OAuth provider. PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks.
Implement refresh token rotationAccess tokens expire quickly (15 min). Refresh tokens enable getting new access tokens without re-logging in - but they must be rotated to prevent replay attacks.
Use NextAuth.js for framework-level authNextAuth.js handles the entire OAuth flow, session management, and JWT handling in 20 lines of config - preventing auth bugs from custom implementation.
Secure token storage and transmissionStoring tokens in localStorage exposes them to XSS. HttpOnly cookies prevent JavaScript access - the right default for session tokens.

Output Format

Auth setup: NextAuth with multiple providers, JWT with custom claims, HttpOnly cookie storage, and refresh token rotation.

Auth layers:
  Provider: NextAuth / Clerk / Supabase Auth
  Token storage: HttpOnly secure cookie
  Access token TTL: 15 minutes
  Refresh token TTL: 30 days (rotated)
  CSRF: SameSite=Lax + state param in OAuth
  Session: server-verified on every request

Examples

Input

Output

Edge Cases & Gotchas

Token revocation - JWTs can't be 'deleted' - they're valid until expiry. For logout or account deletion, maintain a short-lived revocation list (Redis set) or use opaque session tokens instead of JWTs.
Leaked refresh token - Refresh token rotation detects leaks: if a stolen refresh token is used after it's been rotated, the new rotation will see a mismatch and invalidate the entire session family.
Open redirect in redirect_uri - OAuth redirect_uri must be validated against a whitelist - never allow dynamic redirect_uri parameters. An open redirect turns your OAuth flow into a phishing tool.
Clock skew in JWT validation - Distributed systems have clock skew. Allow 5-second clock skew in JWT validation (most libraries have a clockTolerance option) to prevent valid tokens from being rejected.

When to Break These Rules

Use Clerk or Auth0 instead of NextAuth for enterprise features (SSO, SAML, audit logs, MFA, organization management) - implementing these from scratch takes months.
Use API keys instead of OAuth for machine-to-machine API authentication - OAuth is designed for user delegation, not service-to-service auth.

Reference Files

https://authjs.dev/
https://datatracker.ietf.org/doc/html/rfc7636