JWT Authentication Deep Dive — Comprehensive JWT Auth Implementation

// JWT validation middleware with JWKS rotation
const jwksClient = require('jwks-rsa');

const client = jwksClient({
  jwksUri: 'https://auth.example.com/.well-known/jwks.json',
  cache: true,
  cacheMaxEntries: 5,
  cacheMaxAge: 3600000 // 1 hour
});

async function validateJWT(token) {
  const decoded = jwt.decode(token, { complete: true });
  if (!decoded || !decoded.header) throw new Error('Invalid token structure');

  const signingKey = await client.getSigningKey(decoded.header.kid);
  const publicKey = signingKey.getPublicKey();

  return jwt.verify(token, publicKey, {
    algorithms: ['RS256'],
    issuer: 'https://auth.example.com',
    audience: 'https://api.example.com',
    clockTolerance: 30,
    maxAge: '15m'
  });
}

// Token structure inspection
app.post('/auth/debug/token', async (req, res) => {
  const token = req.body.token;
  const parts = token.split('.');

  const header = JSON.parse(atob(parts[0]));
  const payload = JSON.parse(atob(parts[1]));

  res.json({
    header: {
      alg: header.alg,
      typ: header.typ,
      kid: header.kid
    },
    payload: {
      sub: payload.sub,
      iss: payload.iss,
      aud: payload.aud,
      exp: new Date(payload.exp * 1000).toISOString(),
      iat: new Date(payload.iat * 1000).toISOString(),
      scp: payload.scp,
      permissions: payload.permissions
    }
  });
});