Authentication & Authorization: Getting the Fundamentals Right
Most auth bugs aren't in the JWT implementation. They're in the authorization logic around it.
Authentication and authorization are frequently conflated but solve different problems. Authentication answers "who are you?" Authorization answers "what are you allowed to do?" Getting this distinction right in your codebase makes both easier to reason about and audit.
For authentication, the current standard for stateless APIs is JWT (JSON Web Tokens). The common mistake isn't in implementing JWT — libraries handle the crypto correctly — it's in the token lifecycle. Short-lived access tokens (15 minutes) paired with longer-lived refresh tokens (7–30 days) is the right pattern. Long-lived access tokens that never expire mean a stolen token is valid indefinitely, which is an unacceptable security posture.
Store refresh tokens server-side with a rotation strategy: each use issues a new refresh token and invalidates the previous one. This means a stolen refresh token is detectable — if the old token is used after rotation, that's a signal of compromise and the entire token family should be revoked.
For authorization, the most common architectural mistake is embedding authorization logic in application code scattered across endpoints. When requirements change — a new role, a new permission — you're hunting across the codebase for every place that logic lives. Centralize authorization: use a dedicated authorization service or middleware that evaluates permissions in one place, with a clear data model (roles → permissions → resources).
RBAC (Role-Based Access Control) covers most use cases. ABAC (Attribute-Based Access Control) is more expressive but more complex — reach for it only when RBAC becomes unmaintainable. The rule of thumb: start with RBAC and reach for ABAC when you find yourself creating roles like "user-who-can-edit-their-own-records-but-not-others." That's an attribute, not a role.
Audit logging is not optional for any system handling sensitive data. Every authentication event and every significant authorization decision should produce an immutable log entry. You will need this for debugging, compliance, and incident response.