Authentication notes: OAuth2, MFA and JWT
- Security
- TypeScript
Auth is the part of an app you never want to be creative with. These are the rules I settled on while building SecureAuth.
Keep access tokens short
Access tokens live minutes, not days. Refresh tokens rotate on every use, and reuse of an old one revokes the whole session family. A stolen token then has a very small window.
Put MFA at the step-up, not just the door
Prompt for a second factor at sign-in, and again before sensitive actions such as changing email or exporting data. Sessions that were fine a minute ago should not automatically be trusted for everything.
Log what you would want during an incident
Record sign-ins, factor changes and token revocations with enough context to reconstruct a timeline, and never log the secrets themselves.