Articles for people who
ship the stack
Rewrites on React, Node.js, TypeScript and AI. A translated body is shown when it exists. If it does not, you see the English text and a note that says so.
Tagged: JWT
Mapping the Auth Vocabulary: API Keys, Sessions, JWT, OAuth2, OIDC, SSO
Learn how API keys, sessions, JWTs, OAuth2, OpenID Connect and SSO fit together by sorting each one under a single question: who is calling, or what may they do.
10 min readMoving a React App's JWT Out of localStorage and Into HttpOnly Cookies
Learn why localStorage JWTs fall to any XSS, how HttpOnly cookies with SameSite, rotation and a BFF shrink the risk, and which pitfalls remain in React apps.
9 min readRole-Based Access Control in Express with JWT and Two Middlewares
Learn how to enforce role-based access in an Express API by pairing JWT authentication middleware with a reusable authorize() guard, and when to answer 401 versus 403.
4 min readExpress and Axios Token Refresh, Traced Request by Request
Build a JWT access and refresh flow with an Express backend and an Axios client, then trace how a 401 becomes one shared refresh and a transparent retry.
8 min readMovieVault Walkthrough: A Watchlist API With Express 5, Prisma 7 and JWT
MovieVault, a timed full-stack exercise: a watchlist API on Express 5, Prisma 7 and JWT, with review notes on ownership checks, cascades and error handling.
14 min readBuilding Production-Ready JWT Authentication in Node.js APIs
How to hash passwords, issue short-lived JWTs, add refresh tokens and revocation, separate authorization, resist brute force and test that auth fails correctly.
13 min readExpress API Security: JWT and OAuth, Validation, Rate Limiting, Monitoring
Express API security in practice: JWT and OAuth authentication, authorization, encryption, input validation, rate limiting and the logging that catches attacks.
22 min readWhen JWT Auth Turns Stateful: A Case for Server-Side Sessions in Node
Blocklists and refresh stores make JWT authentication stateful anyway. Postgres-backed Express sessions in Node.js are simpler, and where JWTs still fit well.
7 min readWhy Concurrent 401s Log Users Out, and the Single-Flight Refresh Fix
How parallel requests and refresh-token rotation race each other into surprise logouts, and how one shared refresh promise in an Axios interceptor prevents it.
6 min read
About these articles
Request a 24h estimate
Need the same stack in a production operator layer? Send the brief — estimate within 24 hours.