ToolypetMCP
intermediate4 minutessecurity

JWT Authentication Setup

Set up JWT-based authentication: generate tokens, create signing keys, and implement TOTP for 2FA.

jwtauthenticationtotp2fa

Cuándo usar esta receta

Complete JWT authentication setup for web APIs. Combines token generation with 2FA for enhanced security, following OWASP best practices.

Pasos

1

Create a secure signing key

Indicación:Generate a 256-bit random secret in hex format for JWT signing
2

Create a signed JWT token

Indicación:Generate a JWT with payload {sub: 'user123', role: 'admin'} using HS256 and the secret, expires in 1 hour
3

Verify the token structure

Indicación:Decode the generated JWT to verify its header and payload
4

Set up two-factor authentication

Indicación:Generate a TOTP secret for 2FA with issuer 'MyApp'

Preguntas frecuentes

Should I use HS256 or RS256 for JWT?

Use HS256 for simple setups where the same server signs and verifies. Use RS256 for microservices where different services verify tokens with a public key.

How long should JWT tokens last?

Access tokens: 15 minutes to 1 hour. Refresh tokens: 7-30 days. Shorter lifetimes reduce the impact of token theft.

Recetas relacionadas