Token Security & Privacy Best Practices — JWT, API Keys, Sessions

res.cookie('accessToken', token, {
  httpOnly: true,       // JS cannot access
  secure: true,         // HTTPS only
  sameSite: 'strict',   // No cross-site sending
  maxAge: 15 * 60 * 1000, // 15 minutes
  path: '/',
});

app.post('/auth/refresh', async (req, res) => {
  const { refreshToken } = req.cookies;

  // Verify refresh token
  const payload = jwt.verify(refreshToken, REFRESH_SECRET);

  // Check it exists in DB (not revoked)
  const stored = await db.refreshTokens.findOne({ token: refreshToken, userId: payload.sub });
  if (!stored) return res.status(401).json({ error: 'Invalid refresh token' });

  // Rotate: delete old, create new
  await db.refreshTokens.delete({ token: refreshToken });
  const newRefreshToken = crypto.randomBytes(32).toString('hex');
  await db.refreshTokens.create({ token: newRefreshToken, userId: payload.sub });

  // Issue new access token
  const accessToken = jwt.sign({ sub: payload.sub }, ACCESS_SECRET, { expiresIn: '15m' });

  res.cookie('refreshToken', newRefreshToken, { httpOnly: true, secure: true });
  res.json({ accessToken });
});

// When initiating OAuth flow, generate a random state
const state = crypto.randomBytes(32).toString('hex');

// Store in session/cookie
req.session.oauthState = state;

// Add to authorization URL
const authUrl = `https://accounts.google.com/o/oauth2/v2/auth?
  client_id=${CLIENT_ID}
  &redirect_uri=${REDIRECT_URI}
  &response_type=code
  &scope=openid+email+profile
  &state=${state}`;  // ← critical anti-CSRF parameter

// On callback — ALWAYS verify state matches
app.get('/auth/callback', (req, res) => {
  if (req.query.state !== req.session.oauthState) {
    return res.status(403).json({ error: 'State mismatch — potential CSRF attack' });
  }
  // Proceed with code exchange...
});

import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],     // No inline scripts — protects against XSS
      styleSrc: ["'self'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'", "https://api.yourservice.com"],
      frameSrc: ["'none'"],      // No iframes
      objectSrc: ["'none'"],
    },
  },
  hsts: {
    maxAge: 31536000,           // 1 year
    includeSubDomains: true,
    preload: true,              // HTTPS only — tokens never sent over HTTP
  },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
}));

// Additional CORS configuration
app.use(cors({
  origin: ['https://yourapp.com'],   // Whitelist only your domain
  credentials: true,                 // Allow cookies
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
}));