Home

Extend

Hashnode Pro
Hashnode for Agents

Resources

The foreword
Hashnode gql skill

Buildful - AI coding agent that delivers frontier-level results at a fraction of the cost Bug0 - The AI-native e2e QA regression testing Hackathons Changelog Brand @hashnode on X Hashnode on LinkedIn Support - hello+support@hashnode.com Code of Conduct Terms Privacy Sitemap

Search Hashnode

Search posts, tags, users, and pages

Discussion on "Handling authentication in NodeJS using JWT Tokens 🚀" | Hashnode

Feed/

Discussion

Jaydeep Dey

Innovative developer skilled in blockchain dApps, Solidity, Ethereum, and MERN stack development.

Dec 5, 2022

Handling authentication in NodeJS using JWT Tokens 🚀

Introduction The process of authenticating a user's identity involves obtaining credentials and utilizing those credentials to verify the user's identity. We all authenticate into several services in our day-to-day life, for example logging into pc, ...

jaydeepdey03.hashnode.dev11 min read

#refreshtoken #accesstoken #authentication #jwt #nodejs

Responses1

Markdown supported · ⌘↵ to post

José Pablo Ramírez Vargas

Senior Software Developer @ Intel

Dec 11, 2022

Hello, I have a question. I see you talk about "refresh tokens stored in the database". Why are you storing tokens in the database? It is as insecure as saving a password in clear text. What is the purpose of having all the tokens saved since it is so risky?

Thanks for pointing it out Jose. In production environment, we aren't suppose to reveal the token, both in the client side as well as the server side. The steps I have mentioned are to be followed in the development environment. In some scenario, people often encrypt refreshToken and store it in database. Storing tokens in clear text in not recommended.

You can refer to this link for more detailed explaination:

stackoverflow.com/questions/59511628/is-it-secure…

Jaydeep Dey

Innovative developer skilled in blockchain dApps, Solidity, Ethereum, and MERN stack development.

Dec 11, 2022