Token-Based Authentication & JWTs

import jwt from 'jsonwebtoken';

const SECRET_KEY = process.env.JWT_SECRET || 'super-secure-production-secret-key-32b';
const ALGORITHM = 'HS256';

interface TokenPayload {
  sub: string;
  role: string;
  exp?: number;
}

export function generateAccessToken(userId: string, role: string): string {
  return jwt.sign({ sub: userId, role }, SECRET_KEY, {
    algorithm: ALGORITHM,
    expiresIn: '15m',
  });
}

export function verifyAccessToken(token: string): TokenPayload | null {
  try {
    // Explicitly pass algorithms array to block alg:none attack
    return jwt.verify(token, SECRET_KEY, { algorithms: [ALGORITHM] }) as TokenPayload;
  } catch (err: any) {
    if (err.name === 'TokenExpiredError') {
      console.warn('Token expired at:', err.expiredAt);
    } else {
      console.error('Invalid token:', err.message);
    }
    return null;
  }
}
        

package main

import (
	"errors"
	"fmt"
	"time"
	"github.com/golang-jwt/jwt/v5"
)

var secretKey = []byte("super-secure-production-secret-key-32b")

type CustomClaims struct {
	Role string `json:"role"`
	jwt.RegisteredClaims
}

func GenerateToken(userID, role string) (string, error) {
	claims := CustomClaims{
		Role: role,
		RegisteredClaims: jwt.RegisteredClaims{
			Subject:   userID,
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)),
			IssuedAt:  jwt.NewNumericDate(time.Now()),
		},
	}
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	return token.SignedString(secretKey)
}

func VerifyToken(tokenString string) (*CustomClaims, error) {
	token, err := jwt.ParseWithClaims(tokenString, &CustomClaims{}, func(token *jwt.Token) (interface{}, error) {
		// Enforce HS256 to prevent HMAC vs RSA key confusion attacks
		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
		}
		return secretKey, nil
	})

	if err != nil {
		return nil, err
	}

	if claims, ok := token.Claims.(*CustomClaims); ok && token.Valid {
		return claims, nil
	}
	return nil, errors.New("invalid token")
}
        

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;
import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;
import java.util.Date;

public class JwtService {
    private static final String SECRET = "super-secure-production-secret-key-32b";
    private static final SecretKey KEY = Keys.hmacShaKeyFor(SECRET.getBytes(StandardCharsets.UTF_8));

    public static String generateToken(String userId, String role) {
        return Jwts.builder()
            .subject(userId)
            .claim("role", role)
            .issuedAt(new Date())
            .expiration(new Date(System.currentTimeMillis() + 15 * 60 * 1000))
            .signWith(KEY)
            .compact();
    }

    public static Claims verifyToken(String token) {
        return Jwts.parser()
            .verifyWith(KEY)
            .build()
            .parseSignedClaims(token)
            .getPayload();
    }
}
        

#include <jwt-cpp/jwt.h>
#include <iostream>
#include <chrono>

const std::string SECRET = "super-secure-production-secret-key-32b";

std::string generate_jwt(const std::string& user_id, const std::string& role) {
    auto token = jwt::create()
        .set_issuer("auth.systemdesign.website")
        .set_type("JWT")
        .set_subject(user_id)
        .set_payload_claim("role", jwt::claim(role))
        .set_issued_at(std::chrono::system_clock::now())
        .set_expires_at(std::chrono::system_clock::now() + std::chrono::minutes{15})
        .sign(jwt::algorithm::hs256{SECRET});
    return token;
}

bool verify_jwt(const std::string& token_str) {
    try {
        auto verifier = jwt::verify()
            .allow_algorithm(jwt::algorithm::hs256{SECRET})
            .with_issuer("auth.systemdesign.website");
        auto decoded = jwt::decode(token_str);
        verifier.verify(decoded);
        return true;
    } catch (const std::exception& e) {
        std::cerr << "Verification failed: " << e.what() << std::endl;
        return false;
    }
}