Authentication Security

JWT token security and best practices

Overview

Zarna uses JWT (JSON Web Tokens) for API authentication with industry-standard security practices.

Token Security

Token Structure

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.    # Header (algorithm, type)
eyJzdWIiOiJ1c2VyLWlkIiwiZmlybV9pZCI6... # Payload (claims)
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c  # Signature

Secure Storage

Development

localStorage is acceptable for development:

localStorage.setItem('access_token', token)

Risks: XSS vulnerabilities can access localStorage

Production

HttpOnly Cookies are recommended:

# Backend sets cookie
response.set_cookie(
  "access_token",
  token,
  httponly=True,      # Prevents JavaScript access
  secure=True,        # HTTPS only
  samesite="strict",  # CSRF protection
  max_age=86400       # 24 hours
)

Benefits: Protected from XSS attacks

Best Practices

Use HTTPS in production

Always use HTTPS to prevent token interception

Short token expiration

Access tokens: 24 hours max Refresh tokens: 7 days max

Strong JWT secrets

Use 256+ bit random secrets:

openssl rand -base64 64

Implement token rotation

Issue new refresh token on each use, invalidate old ones

Validate all claims

Check expiration, issuer, audience on every request

OWASP Top 10 Compliance

• ✅ A01 Broken Access Control: RLS + JWT
• ✅ A02 Cryptographic Failures: HTTPS + encrypted secrets
• ✅ A03 Injection: Parameterized queries
• ✅ A05 Security Misconfiguration: Secure defaults
• ✅ A07 Identification & Auth Failures: JWT + OAuth

Next Steps

OAuth Security

OAuth best practices

API Security

API protection

Auth Flow

Authentication patterns