| id | SKL-jwt-JWTAUTHENTICATION |
| name | Jwt Authentication |
| description | This skill provides comprehensive patterns for implementing JWT (JSON Web Token) authentication in web applications. It covers token generation, verification, access/refresh token strategy, secure sto |
| version | 1.0.0 |
| status | active |
| owner | @cerebra-team |
| last_updated | 2026-02-22 |
| category | Backend |
| tags | ["api","backend","server","database"] |
| stack | ["Python","Node.js","REST API","GraphQL"] |
| difficulty | Intermediate |
Jwt Authentication
Skill Profile
(Select at least one profile to enable specific modules)
Overview
This skill provides comprehensive patterns for implementing JWT (JSON Web Token) authentication in web applications. It covers token generation, verification, access/refresh token strategy, secure storage in httpOnly cookies, token rotation, revocation, and production-ready security practices.
Why This Matters
- Stateless Authentication: JWTs enable stateless authentication, reducing database load
- Scalability: No server-side session storage required, ideal for microservices
- Cross-Origin Support: Works seamlessly with CORS for SPA and mobile apps
- Security: Proper implementation with httpOnly cookies and refresh tokens provides robust security
Core Concepts & Rules
1. Core Principles
- Follow established patterns and conventions
- Maintain consistency across codebase
- Document decisions and trade-offs
2. Implementation Guidelines
- Start with the simplest viable solution
- Iterate based on feedback and requirements
- Test thoroughly before deployment
Inputs / Outputs / Contracts
- Inputs:
- Environment variables:
JWT_ACCESS_SECRET, JWT_REFRESH_SECRET, JWT_ISSUER, JWT_AUDIENCE
- Request headers:
Authorization: Bearer <token> or cookies
- Configuration: token expiry times, algorithm selection
- Entry Conditions:
- JWT secrets configured in environment
- User database with credentials
- Redis or in-memory store for token revocation (optional)
- Outputs:
