{
  "id": 8077658,
  "title": "Building an Auth Backend: JWT, Refresh Tokens, Rate Limiting, and Timing Attacks Explained",
  "url": "https://urgent.news/2026/09/17/building-an-auth-backend-jwt-refresh-tokens-rate-limiting-and-timing",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-17T18:12:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/banujafar/building-an-auth-backend-jwt-refresh-tokens-rate-limiting-and-timing-attacks-explained-3mom"
  },
  "original_language": "en",
  "account": "Building a backend often involves the same essential components: access and refresh tokens, a rate limiter, a secure login process, and uniform response formats. While each piece may seem simple, understanding why they are implemented in a particular way can be more challenging than coding them. To address this, the author created an interactive page that takes readers through the entire backend architecture step by step. The core of the system is a six-section pipeline, each section functioning as an interactive element of the backend. The order of middleware plays a crucial role in the system's overall function, with some aspects being intentional design decisions and others following conventions. The middleware sequence includes express.json(), helmet(), cors(), and other Express default settings. Contrary to one might assume, the rate limiter is placed before authentication middleware. This timing allows the rate limiter to prevent abuse before it reaches database-intensive handlers. The explainer animation helps visualize the request flow, emphasizing that the rate limiter runs before user authentication, ensuring that req.user is undefined during this phase. Two crucial types of tokens are discussed: access tokens, which are short-lived and verified via a signature, and refresh tokens, which are long-lived, tracked in the database, and checked against a stored hash upon each request. This separation is crucial because it enables revoking the refresh token while keeping the access token's verification process lightweight. The demo showcases how access tokens count down, while refresh tokens remain constant, highlighting the differing levels of trust associated with each token. It's worth noting that this refresh token does not rotate upon use, leaving a potential security gap regarding leaked tokens. Moreover, the author emphasizes that the measured simulation results in the demo reflect a theoretical understanding of the race condition, rather than an actual production benchmark. Transitioning to another important aspect of backend security, the author addresses timing attacks in login routes. A typical login endpoint that returns immediately upon user inexistence is fast, whereas one that performs a full password comparison is slow. If both endpoints return the same error message, an attacker can infer information based on response times, thereby exploiting the timing disparity. To mitigate this risk, the author suggests running the password comparison unconditionally against a dummy hash when no user is found, ensuring a consistent response time regardless of the scenario. The demo provides a toggle option between these two approaches, clearly illustrating the difference in response times. While the login route's vulnerability is addressed, it's important to clarify that this fix specifically targets this route and not all potential timing leaks within the system.",
  "summary": "Every backend I start ends up with the same handful of pieces: access and refresh tokens, a rate limiter that survives concurrent requests instead of quietly losing count, a login route that doesn't leak information through response time, and one consistent response shape across every route. None of it is exotic. But explaining why each piece is shaped the way it is always took longer than…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}