JWT Authentication (Access + Refresh Token) in Express.js

Modern authentication system using secure JSON Web Tokens (JWT). A must-learn topic for backend developers.

---

🔷 What is JWT (JSON Web Token)?

JWT হলো একটি secure token-based authentication system যেখানে server কোনও session store করে না। Server শুধুমাত্র token verify করে user কে access দেয়।

🔷 Why We Use Access Token + Refresh Token?

• Access Token: Short-lived, 15–30 minutes valid.
• Refresh Token: Long-lived, 7–30 days valid.

🔷 Install Required Packages

npm install jsonwebtoken bcryptjs dotenv cookie-parser
    

🔷 Environment Variables (.env)

ACCESS_TOKEN_SECRET=yourAccessSecretKey
REFRESH_TOKEN_SECRET=yourRefreshSecretKey
ACCESS_TOKEN_EXPIRE=15m
REFRESH_TOKEN_EXPIRE=7d
    

🔷 Generate Tokens (Functions)

const jwt = require("jsonwebtoken");

const generateAccessToken = (user) => {
    return jwt.sign(user, process.env.ACCESS_TOKEN_SECRET, {
        expiresIn: process.env.ACCESS_TOKEN_EXPIRE
    });
};

const generateRefreshToken = (user) => {
    return jwt.sign(user, process.env.REFRESH_TOKEN_SECRET, {
        expiresIn: process.env.REFRESH_TOKEN_EXPIRE
    });
};
    

🔷 User Login — Generate Tokens

app.post("/login", async (req, res) => {
    const { email, password } = req.body;

    const user = await User.findOne({ email });
    if (!user) return res.status(400).json({ message: "User not found" });

    const isMatch = await bcrypt.compare(password, user.password);

    if (!isMatch) return res.status(400).json({ message: "Incorrect password" });

    const payload = { id: user._id, email: user.email };

    const accessToken = generateAccessToken(payload);
    const refreshToken = generateRefreshToken(payload);

    res.cookie("refreshToken", refreshToken, {
        httpOnly: true,
        secure: false,
        sameSite: "strict"
    });

    return res.json({
        message: "Login successful",
        accessToken,
    });
});
    

🔷 Token Verification Middleware

const verifyAccessToken = (req, res, next) => {
    const authHeader = req.headers["authorization"];
    const token = authHeader && authHeader.split(" ")[1];

    if (!token) return res.sendStatus(401);

    jwt.verify(token, process.env.ACCESS_TOKEN_SECRET, (err, user) => {
        if (err) return res.sendStatus(403);
        req.user = user;
        next();
    });
};
    

🔷 Refresh Token Route (Generate New Access Token)

app.post('/refresh', (req, res) => {
    const refreshToken = req.cookies.refreshToken;

    if (!refreshToken) return res.sendStatus(401);

    jwt.verify(refreshToken, process.env.REFRESH_TOKEN_SECRET, (err, user) => {
        if (err) return res.sendStatus(403);

        const newAccessToken = generateAccessToken({ id: user.id, email: user.email });

        res.json({ accessToken: newAccessToken });
    });
});
    

🔷 Protected Route Example

app.get("/profile", verifyAccessToken, (req, res) => {
    res.json({
        message: "Profile data fetched",
        user: req.user
    });
});
    

🔷 Logout (Clear Refresh Token)

app.post("/logout", (req, res) => {
    res.clearCookie("refreshToken");
    res.json({ message: "Logged out successfully" });
});
    

🔷 Summary

• JWT হলো stateless অথেন্টিকেশন সিস্টেম।
• Access Token কম সময়ের জন্য valid থাকে।
• Refresh Token দিয়ে নতুন Access Token নেওয়া যায়।
• Cookies ব্যবহার করলে Refresh Token আরও secure হয়।
• Protected route এ middleware ব্যবহার করা হয়।

---

✔ এই guide আপনার Express.js Authentication tutorial এর জন্য একদম perfect!