10. Authentication Architecture: JWT Access/Refresh Tokens & Sliding Sessions • Node.js Backend Architecture: Libuv to High-Scale Microservices • Rishabh Ki Kaksha

Stateless JWT authorization scalable hai, lekin JWT ko expire hone se pehle revoke karna impossible hota hai.  
**Production Standard Token Pair Strategy:**

1. **Access Token (Short-Lived: 15 mins):** Memory me rehta hai; har API call ke Authorization header me jata hai.
2. **Refresh Token (Long-Lived: 7 days):** `httpOnly, Secure, SameSite=Strict` Cookie me store hota hai; naya access token mangne ke kaam aata hai.

```
[ Client ] ===(Access Token)===========> [ Protected API ] (Validates signature with 0ms DB check!)
     ⬇ Expired?
[ Client ] ===(Refresh Token Cookie)===> [ /api/auth/refresh ] (Validates in DB/Redis ➔ Issues fresh pair)
```

---

### 2. Refresh Token Rotation & Reuse Detection (The Hacker Trap 🪤)

Agar hacker kisi user ka Refresh Token chura le:
1. Har baar `/refresh` call hone par **Purana Refresh Token delete hota hai aur Naya Refresh Token issue hota hai (Rotation)**.
2. Agar koi purana (already used) token dobara server par aaye ➔ Server detect karta hai ki **Token Replay / Theft** hua hai!
3. Natija: Server us user ke **SAARE ACTIVE SESSIONS aur Tokens ko instantly revoke kar deta hai!**

---

### 3. Redis-Backed Token Blacklist on Logout

```typescript
export async function logoutUser(accessToken: string, expTimestamp: number) {
    const ttl = expTimestamp - Math.floor(Date.now() / 1000);
    if (ttl > 0) {
        // Access token ko uski remaining lifespan tak Redis blacklist me daalo:
        await redis.set(`blacklist:${accessToken}`, "revoked", "EX", ttl);
    }
}
```

---

### 4. Master Comparison Matrix

---

### 5. Interview Ke 3 Sawal Is Topic Se

1. **Access Token ko `localStorage` me store kyu nahi karna chahiye?** -> Kyunki malicious JavaScript (XSS script) `localStorage.getItem()` chala kar access token chura sakti hai; In-memory ya `httpOnly` cookie XSS immune hoti hai.
2. **Asymmetric JWT (RS256) vs Symmetric JWT (HS256) me kya difference hai?** -> HS256 me single shared secret hota hai; RS256 me Auth service Private Key se sign karti hai aur hazaro Microservices Public Key se bina Auth server ko load diye verify karti hain.
3. **Sliding Session expiration kaise implement hoti hai?** -> Jab bhi user active request karta hai, server refresh token cookie ka expiry time aage extend kar deta hai (e.g. +7 days from last activity).

---
**Next Topic:** 11. Node.js Crypto Module: Password Hashing (Argon2 vs bcrypt) & AES-256-GCM

Loading lesson content...

JavaScript

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track