JWT Authentication in Node.js: A Practical Guide (with Express)
Ever logged into an app, closed the tab, come back, and you're still logged in — no password needed? That's almost always JWT doing its job behind the scenes. JWT (JSON Web Token) is one of the most common ways to handle authentication in modern backends. But a lot of developers use it without really understanding what's happening — and that's exactly where security bugs sneak in. Let's fix that.…
JSON Web Tokens (JWT) are widely used for handling authentication in modern backends, but many developers use them without fully understanding the process, which can lead to security issues. A JWT consists of three parts separated by dots: header, payload, and signature. The header indicates the algorithm used to sign the token, the payload contains the actual data such as userId, role, and expiry time, and the signature is a cryptographic stamp created using a secret known only to the server. This signature prevents people from forging tokens.
To create a JWT in a Node.js + Express app, first install the jsonwebtoken library. Upon successful login, sign a token using the user's ID and role, and set an expiry time. Keep the payload small, store the secret in an environment variable, and set an expiration time. When protecting routes, create a middleware that checks the token on every request.
Always verify the token using jwt.verify(), not just decode it. Common mistakes include trusting the payload without verifying, using a weak or leaked secret, not setting an expiry time, and storing the token in localStorage, which can be vulnerable to XSS attacks. Always set an expiration time and use httpOnly cookies for sensitive apps.
Debugging involves inspecting the token using a JWT decoder to check the expiry, payload, and algorithm.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
