1. Setup Configuration
// Configuration pattern
{
"auth": {
"providers": {
"local": {
"enabled": true,
"session_lifetime": "24h",
"token_secret": "your-secure-secret"
},
"oauth": {
"providers": ["google", "github"],
"client_id": "YOUR_CLIENT_ID"
}
},
"password_policy": {
"min_length": 12,
"require_special_chars": true
}
}
}
2. Login Flow
Security Layers
- Multi-factor authentication support
- Rate limiting (IP-based)
- IP geolocation validation
Authentication Flow
Initial request to /auth/login
JWT token issued upon successful authentication
Refresh token stored securely in HTTP-only cookie
Security Best Practices
Token Security
- • AES-256-GCM encryption for sensitive tokens
- • Token expiration after 30 minutes of inactivity
- • Blacklisting system for revoked tokens
Rate Limiting
- • 15 attempts/minute for public endpoints
- • Sliding window rate limiting algorithm
- • IP-based tracking with rotating salt