What are JWT authentication basics in Node.js?

Direct answer

JWT is a signed token (header.payload.signature) proving identity — AceDevHub uses httpOnly cookies not localStorage; verify signature and expiry server-side; short-lived access + refresh rotation; Google OAuth establishes session via backend-issued JWT.

JWTs are stateless claims — but production auth still needs session revocation tables, refresh token storage, and server-side entitlement checks beyond the token payload.

Why interviewers ask

Topic	Practice
Storage	httpOnly Secure SameSite cookie — not localStorage
Verification	Check alg, signature, exp, iss, aud
Payload	sub/userId only — no premium boolean; use entitlements
Refresh	Rotate refresh tokens; revoke on logout all sessions
Google OAuth	Backend exchanges code → creates session JWT

None algorithm attack — reject alg:none; allowlist HS256/RS256.
Secret management — JWT_SECRET in env; rotate with overlap window.
Frontend rule — credentials: 'include' on fetch; AceDevHub lib/api/client.ts pattern.

jwt-verify.mjs

import jwt from "jsonwebtoken";

function verifyAccessToken(token) {
  return jwt.verify(token, process.env.JWT_SECRET, {
    algorithms: ["HS256"],
    issuer: "acedevhub-api",
    maxAge: "15m",
  });
}

// Set cookie on login
reply.setCookie("access_token", accessJwt, {
  httpOnly: true,
  secure: process.env.NODE_ENV === "production",
  sameSite: "lax",
  path: "/",
});