Choosing the Right Authentication Method: JWT, Sessions, or OAuth?

┌─────────┐                    ┌─────────┐
│ Browser │                    │  Server │
└────┬────┘                    └────┬────┘
     │                              │
     │  POST /login                 │
     │  {username, password}        │
     ├─────────────────────────────>│
     │                              │
     │                     Validate credentials
     │                     Create session
     │                     Store in Redis/DB
     │                              │
     │  Set-Cookie: sessionId=abc   │
     │<─────────────────────────────┤
     │                              │
     │  GET /dashboard              │
     │  Cookie: sessionId=abc       │
     ├─────────────────────────────>│
     │                              │
     │                     Lookup session in Redis
     │                     Verify session valid
     │                              │
     │  200 OK (dashboard data)     │
     │<─────────────────────────────┤
     │                              │

// server.js
const express = require('express');
const session = require('express-session');
const RedisStore = require('connect-redis').default;
const { createClient } = require('redis');
const bcrypt = require('bcrypt');

const app = express();

// Create Redis client
const redisClient = createClient({
  host: 'localhost',
  port: 6379,
});
redisClient.connect().catch(console.error);

// Configure session middleware
app.use(
  session({
    store: new RedisStore({ client: redisClient }),
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: {
      secure: true, // HTTPS only
      httpOnly: true, // No JavaScript access
      maxAge: 1000 * 60 * 60 * 24, // 24 hours
      sameSite: 'strict', // CSRF protection
    },
  })
);

// Login route
app.post('/login', async (req, res) => {
  const { username, password } = req.body;

  // Validate credentials (example)
  const user = await db.findUserByUsername(username);
  if (!user || !await bcrypt.compare(password, user.passwordHash)) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  // Create session
  req.session.userId = user.id;
  req.session.username = user.username;
  req.session.role = user.role;

  res.json({ message: 'Login successful' });
});

// Protected route
app.get('/dashboard', requireAuth, async (req, res) => {
  // req.session contains user data
  const userData = await db.findUserById(req.session.userId);
  res.json({ user: userData });
});

// Logout route
app.post('/logout', (req, res) => {
  req.session.destroy((err) => {
    if (err) {
      return res.status(500).json({ error: 'Logout failed' });
    }
    res.clearCookie('connect.sid'); // Clear session cookie
    res.json({ message: 'Logged out successfully' });
  });
});

// Auth middleware
function requireAuth(req, res, next) {
  if (!req.session.userId) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  next();
}

app.listen(3000);

Key: sess:abc123def456
Value: {
  "userId": 42,
  "username": "john_doe",
  "role": "admin",
  "cookie": {
    "expires": "2026-02-04T00:00:00.000Z"
  }
}
TTL: 86400 seconds

┌─────────┐                    ┌─────────┐
│ Browser │                    │  Server │
└────┬────┘                    └────┬────┘
     │                              │
     │  POST /login                 │
     │  {username, password}        │
     ├─────────────────────────────>│
     │                              │
     │                     Validate credentials
     │                     Create JWT:
     │                     {userId: 42, role: "admin"}
     │                     Sign with secret
     │                              │
     │  { token: "eyJhbG..." }      │
     │<─────────────────────────────┤
     │                              │
     │  Store token in memory       │
     │                              │
     │  GET /dashboard              │
     │  Authorization: Bearer eyJ...│
     ├─────────────────────────────>│
     │                              │
     │                     Verify signature
     │                     Extract claims
     │                     Check expiration
     │                              │
     │  200 OK (dashboard data)     │
     │<─────────────────────────────┤
     │                              │

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjQyLCJ1c2VybmFtZSI6ImpvaG4iLCJpYXQiOjE2NDYwNzM2MDAsImV4cCI6MTY0NjE2MDAwMH0.4Adcj0mYmQ2fFQq7oBPR0VZh3KX6N39m8p8h0eEhZHo

// server.js
const express = require('express');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');

const app = express();
app.use(express.json());

const JWT_SECRET = process.env.JWT_SECRET; // Store securely!
const JWT_EXPIRES_IN = '24h';

// Login route
app.post('/login', async (req, res) => {
  const { username, password } = req.body;

  // Validate credentials
  const user = await db.findUserByUsername(username);
  if (!user || !await bcrypt.compare(password, user.passwordHash)) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  // Create JWT
  const token = jwt.sign(
    {
      userId: user.id,
      username: user.username,
      role: user.role,
    },
    JWT_SECRET,
    {
      expiresIn: JWT_EXPIRES_IN,
      issuer: 'myapp.com',
      audience: 'myapp.com',
    }
  );

  res.json({
    token,
    expiresIn: JWT_EXPIRES_IN,
    user: {
      id: user.id,
      username: user.username,
      role: user.role,
    },
  });
});

// Protected route
app.get('/dashboard', authenticateJWT, async (req, res) => {
  // req.user contains decoded JWT payload
  const userData = await db.findUserById(req.user.userId);
  res.json({ user: userData });
});

// JWT Authentication Middleware
function authenticateJWT(req, res, next) {
  const authHeader = req.headers.authorization;

  if (!authHeader) {
    return res.status(401).json({ error: 'No token provided' });
  }

  const token = authHeader.split(' ')[1]; // Bearer TOKEN

  try {
    const decoded = jwt.verify(token, JWT_SECRET, {
      issuer: 'myapp.com',
      audience: 'myapp.com',
    });

    req.user = decoded;
    next();
  } catch (error) {
    if (error.name === 'TokenExpiredError') {
      return res.status(401).json({ error: 'Token expired' });
    }
    if (error.name === 'JsonWebTokenError') {
      return res.status(401).json({ error: 'Invalid token' });
    }
    return res.status(500).json({ error: 'Token verification failed' });
  }
}

// Refresh token endpoint (recommended)
app.post('/refresh', authenticateJWT, async (req, res) => {
  // Verify user still exists and is active
  const user = await db.findUserById(req.user.userId);
  if (!user || !user.active) {
    return res.status(401).json({ error: 'User no longer valid' });
  }

  // Issue new token
  const newToken = jwt.sign(
    {
      userId: user.id,
      username: user.username,
      role: user.role,
    },
    JWT_SECRET,
    { expiresIn: JWT_EXPIRES_IN }
  );

  res.json({ token: newToken });
});

app.listen(3000);

// authService.js
class AuthService {
  async login(username, password) {
    const response = await fetch('/login', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ username, password }),
    });

    const data = await response.json();

    if (response.ok) {
      // Store token in memory (most secure)
      this.token = data.token;
      
      // Or in localStorage (less secure, but survives page refresh)
      // localStorage.setItem('token', data.token);
      
      return data;
    }
    throw new Error(data.error);
  }

  getAuthHeader() {
    return {
      'Authorization': `Bearer ${this.token}`,
    };
  }

  async fetchProtectedData() {
    const response = await fetch('/dashboard', {
      headers: this.getAuthHeader(),
    });

    if (response.status === 401) {
      // Token expired, redirect to login
      this.logout();
      window.location.href = '/login';
    }

    return response.json();
  }

  logout() {
    this.token = null;
    // localStorage.removeItem('token');
  }
}

export default new AuthService();

// Dual-token approach
app.post('/login', async (req, res) => {
  // ... validate credentials ...

  // Short-lived access token (15 minutes)
  const accessToken = jwt.sign(
    { userId: user.id, role: user.role },
    ACCESS_TOKEN_SECRET,
    { expiresIn: '15m' }
  );

  // Long-lived refresh token (7 days)
  const refreshToken = jwt.sign(
    { userId: user.id, tokenType: 'refresh' },
    REFRESH_TOKEN_SECRET,
    { expiresIn: '7d' }
  );

  // Store refresh token in database (allows revocation)
  await db.saveRefreshToken({
    userId: user.id,
    token: refreshToken,
    expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
  });

  res.json({
    accessToken,
    refreshToken,
  });
});

// Refresh endpoint
app.post('/refresh', async (req, res) => {
  const { refreshToken } = req.body;

  try {
    // Verify refresh token
    const decoded = jwt.verify(refreshToken, REFRESH_TOKEN_SECRET);

    // Check if token exists in database
    const storedToken = await db.findRefreshToken(refreshToken);
    if (!storedToken || storedToken.revoked) {
      return res.status(401).json({ error: 'Invalid refresh token' });
    }

    // Issue new access token
    const accessToken = jwt.sign(
      { userId: decoded.userId },
      ACCESS_TOKEN_SECRET,
      { expiresIn: '15m' }
    );

    res.json({ accessToken });
  } catch (error) {
    res.status(401).json({ error: 'Invalid refresh token' });
  }
});

// Logout (revoke refresh token)
app.post('/logout', async (req, res) => {
  const { refreshToken } = req.body;
  await db.revokeRefreshToken(refreshToken);
  res.json({ message: 'Logged out' });
});

┌─────────┐              ┌─────────┐              ┌──────────┐
│ Browser │              │Your App │              │  Google  │
└────┬────┘              └────┬────┘              └────┬─────┘
     │                        │                        │
     │  Click "Login w/Google"│                        │
     ├───────────────────────>│                        │
     │                        │                        │
     │  Redirect to Google    │                        │
     │<───────────────────────┤                        │
     │                        │                        │
     │  GET /authorize?client_id=...                   │
     ├────────────────────────────────────────────────>│
     │                        │                        │
     │                        │         User logs in   │
     │                        │         Grants consent │
     │                        │                        │
     │  Redirect with auth code                        │
     │<────────────────────────────────────────────────┤
     │                        │                        │
     │  GET /callback?code=xyz│                        │
     ├───────────────────────>│                        │
     │                        │                        │
     │                        │  POST /token           │
     │                        │  {code, client_secret} │
     │                        ├───────────────────────>│
     │                        │                        │
     │                        │  { access_token }      │
     │                        │<───────────────────────┤
     │                        │                        │
     │                        │  GET /userinfo         │
     │                        │  Authorization: Bearer │
     │                        ├───────────────────────>│
     │                        │                        │
     │                        │  { email, name, ... }  │
     │                        │<───────────────────────┤
     │                        │                        │
     │  Set session/JWT       │                        │
     │<───────────────────────┤                        │
     │                        │                        │

npm install passport passport-google-oauth20 express-session

// server.js
const express = require('express');
const passport = require('passport');
const GoogleStrategy = require('passport-google-oauth20').Strategy;
const session = require('express-session');

const app = express();

// Session configuration
app.use(
  session({
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
  })
);

// Initialize Passport
app.use(passport.initialize());
app.use(passport.session());

// Configure Google Strategy
passport.use(
  new GoogleStrategy(
    {
      clientID: process.env.GOOGLE_CLIENT_ID,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
      callbackURL: '/auth/google/callback',
    },
    async (accessToken, refreshToken, profile, done) => {
      try {
        // Find or create user in database
        let user = await db.findUserByGoogleId(profile.id);

        if (!user) {
          // Create new user
          user = await db.createUser({
            googleId: profile.id,
            email: profile.emails[0].value,
            name: profile.displayName,
            picture: profile.photos[0].value,
            provider: 'google',
          });
        } else {
          // Update user info
          user = await db.updateUser(user.id, {
            name: profile.displayName,
            picture: profile.photos[0].value,
            lastLogin: new Date(),
          });
        }

        return done(null, user);
      } catch (error) {
        return done(error, null);
      }
    }
  )
);

// Serialize user for session
passport.serializeUser((user, done) => {
  done(null, user.id);
});

// Deserialize user from session
passport.deserializeUser(async (id, done) => {
  try {
    const user = await db.findUserById(id);
    done(null, user);
  } catch (error) {
    done(error, null);
  }
});

// Routes
app.get(
  '/auth/google',
  passport.authenticate('google', {
    scope: ['profile', 'email'],
  })
);

app.get(
  '/auth/google/callback',
  passport.authenticate('google', {
    failureRedirect: '/login',
  }),
  (req, res) => {
    // Successful authentication
    res.redirect('/dashboard');
  }
);

// Protected route
app.get('/dashboard', requireAuth, (req, res) => {
  res.json({ user: req.user });
});

// Logout
app.get('/logout', (req, res) => {
  req.logout((err) => {
    if (err) return res.status(500).json({ error: 'Logout failed' });
    res.redirect('/');
  });
});

// Auth middleware
function requireAuth(req, res, next) {
  if (req.isAuthenticated()) {
    return next();
  }
  res.redirect('/login');
}

app.listen(3000);

<!-- login.html -->
<!DOCTYPE html>
<html>
<head>
  <title>Login</title>
</head>
<body>
  <h1>Login</h1>
  
  <!-- Traditional login form -->
  <form action="/login" method="POST">
    <input type="text" name="username" placeholder="Username" required>
    <input type="password" name="password" placeholder="Password" required>
    <button type="submit">Login</button>
  </form>

  <hr>

  <!-- OAuth login buttons -->
  <a href="/auth/google">
    <button>Login with Google</button>
  </a>
  
  <a href="/auth/github">
    <button>Login with GitHub</button>
  </a>
  
  <a href="/auth/facebook">
    <button>Login with Facebook</button>
  </a>
</body>
</html>

// GitHub Strategy
passport.use(
  new GitHubStrategy(
    {
      clientID: process.env.GITHUB_CLIENT_ID,
      clientSecret: process.env.GITHUB_CLIENT_SECRET,
      callbackURL: '/auth/github/callback',
    },
    async (accessToken, refreshToken, profile, done) => {
      // Similar to Google strategy
      let user = await db.findOrCreateUser({
        providerId: profile.id,
        provider: 'github',
        email: profile.emails[0].value,
        username: profile.username,
      });
      done(null, user);
    }
  )
);

// GitHub routes
app.get('/auth/github', passport.authenticate('github', { scope: ['user:email'] }));
app.get('/auth/github/callback', passport.authenticate('github', { failureRedirect: '/login' }), (req, res) => {
  res.redirect('/dashboard');
});

CREATE TABLE users (
  id SERIAL PRIMARY KEY,
  email VARCHAR(255) UNIQUE NOT NULL,
  password_hash VARCHAR(255), -- NULL for OAuth users
  name VARCHAR(255),
  picture VARCHAR(500),
  created_at TIMESTAMP DEFAULT NOW()
);

CREATE TABLE oauth_accounts (
  id SERIAL PRIMARY KEY,
  user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
  provider VARCHAR(50) NOT NULL, -- 'google', 'github', 'facebook'
  provider_user_id VARCHAR(255) NOT NULL,
  access_token TEXT,
  refresh_token TEXT,
  token_expires_at TIMESTAMP,
  created_at TIMESTAMP DEFAULT NOW(),
  UNIQUE(provider, provider_user_id)
);

app.get('/auth/google', (req, res) => {
  const state = crypto.randomBytes(16).toString('hex');
  req.session.oauthState = state;
  
  const authUrl = `https://accounts.google.com/o/oauth2/v2/auth?` +
    `client_id=${CLIENT_ID}&` +
    `redirect_uri=${REDIRECT_URI}&` +
    `response_type=code&` +
    `scope=profile email&` +
    `state=${state}`;
  
  res.redirect(authUrl);
});

app.get('/auth/google/callback', (req, res) => {
  const { state, code } = req.query;
  
  // Verify state
  if (state !== req.session.oauthState) {
    return res.status(400).json({ error: 'Invalid state' });
  }
  
  // ... continue with token exchange ...
});

Is this a public-facing consumer app?
│
├─ Yes → Do users expect social login?
│   │
│   ├─ Yes → Use OAuth 2.0 (+ JWT/Sessions for your own auth)
│   └─ No → Is it an API or mobile app?
│       │
│       ├─ Yes → Use JWT
│       └─ No → Use Sessions
│
└─ No → Is it an internal/enterprise app?
    │
    ├─ Yes → Do you need microservices?
    │   │
    │   ├─ Yes → Use JWT
    │   └─ No → Use Sessions
    │
    └─ Is it a mobile app?
        │
        ├─ Yes → Use JWT
        └─ No → Use Sessions

// Why Sessions?
// - Shopping cart state changes frequently
// - Need immediate logout (payment security)
// - Traditional web app with server-side rendering
// - CSRF protection already in place

const express = require('express');
const session = require('express-session');
const RedisStore = require('connect-redis').default;
const csrf = require('csurf');

const app = express();

// Session with Redis
app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,
    httpOnly: true,
    maxAge: 1000 * 60 * 60 * 24, // 24 hours
  },
}));

// CSRF protection
app.use(csrf());

// Shopping cart
app.post('/cart/add', requireAuth, csrfProtection, async (req, res) => {
  const { productId, quantity } = req.body;
  
  // Add to session cart
  req.session.cart = req.session.cart || [];
  req.session.cart.push({ productId, quantity });
  
  res.json({ success: true });
});

// Checkout
app.post('/checkout', requireAuth, csrfProtection, async (req, res) => {
  const cart = req.session.cart;
  
  // Process payment
  await processPayment(req.session.userId, cart);
  
  // Clear cart
  req.session.cart = [];
  
  res.json({ success: true });
});

// Why JWT?
// - Mobile apps don't handle cookies well
// - Need stateless API for scaling
// - Multiple mobile platforms (iOS, Android)
// - Offline-first architecture

const express = require('express');
const jwt = require('jsonwebtoken');

const app = express();

// Login returns JWT
app.post('/api/v1/login', async (req, res) => {
  const { email, password } = req.body;
  
  const user = await authenticateUser(email, password);
  
  const accessToken = jwt.sign(
    { userId: user.id, role: user.role },
    process.env.JWT_SECRET,
    { expiresIn: '15m' }
  );
  
  const refreshToken = jwt.sign(
    { userId: user.id, type: 'refresh' },
    process.env.REFRESH_SECRET,
    { expiresIn: '7d' }
  );
  
  // Store refresh token in database
  await db.saveRefreshToken(user.id, refreshToken);
  
  res.json({ accessToken, refreshToken });
});

// Mobile client stores tokens securely
// iOS: Keychain
// Android: EncryptedSharedPreferences

// API endpoints verify JWT
app.get('/api/v1/profile', authenticateJWT, async (req, res) => {
  const user = await db.findUserById(req.user.userId);
  res.json({ user });
});

// Refresh token endpoint
app.post('/api/v1/refresh', async (req, res) => {
  const { refreshToken } = req.body;
  
  try {
    const decoded = jwt.verify(refreshToken, process.env.REFRESH_SECRET);
    
    // Verify token exists in database
    const valid = await db.verifyRefreshToken(decoded.userId, refreshToken);
    if (!valid) {
      return res.status(401).json({ error: 'Invalid refresh token' });
    }
    
    // Issue new access token
    const accessToken = jwt.sign(
      { userId: decoded.userId },
      process.env.JWT_SECRET,
      { expiresIn: '15m' }
    );
    
    res.json({ accessToken });
  } catch (error) {
    res.status(401).json({ error: 'Invalid refresh token' });
  }
});

// authService.js
import * as SecureStore from 'expo-secure-store';

class AuthService {
  async login(email, password) {
    const response = await fetch('https://api.myapp.com/v1/login', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email, password }),
    });
    
    const { accessToken, refreshToken } = await response.json();
    
    // Store tokens securely
    await SecureStore.setItemAsync('accessToken', accessToken);
    await SecureStore.setItemAsync('refreshToken', refreshToken);
    
    return true;
  }
  
  async getAccessToken() {
    let accessToken = await SecureStore.getItemAsync('accessToken');
    
    // Check if token is expired
    const decoded = jwt_decode(accessToken);
    const isExpired = decoded.exp < Date.now() / 1000;
    
    if (isExpired) {
      // Refresh token
      accessToken = await this.refreshToken();
    }
    
    return accessToken;
  }
  
  async refreshToken() {
    const refreshToken = await SecureStore.getItemAsync('refreshToken');
    
    const response = await fetch('https://api.myapp.com/v1/refresh', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ refreshToken }),
    });
    
    const { accessToken } = await response.json();
    await SecureStore.setItemAsync('accessToken', accessToken);
    
    return accessToken;
  }
  
  async fetch(url, options = {}) {
    const accessToken = await this.getAccessToken();
    
    return fetch(url, {
      ...options,
      headers: {
        ...options.headers,
        'Authorization': `Bearer ${accessToken}`,
      },
    });
  }
}

export default new AuthService();

// Why OAuth + JWT?
// - Users expect social login
// - Need to integrate with Google Workspace, GitHub, etc.
// - Multiple services/APIs (microservices)
// - Both web and mobile clients

const express = require('express');
const passport = require('passport');
const jwt = require('jsonwebtoken');

const app = express();

// OAuth for social login
app.get('/auth/google', passport.authenticate('google', { scope: ['profile', 'email'] }));

app.get('/auth/google/callback',
  passport.authenticate('google', { session: false }),
  async (req, res) => {
    // Create JWT after OAuth success
    const accessToken = jwt.sign(
      { userId: req.user.id, role: req.user.role },
      process.env.JWT_SECRET,
      { expiresIn: '1h' }
    );
    
    const refreshToken = jwt.sign(
      { userId: req.user.id, type: 'refresh' },
      process.env.REFRESH_SECRET,
      { expiresIn: '30d' }
    );
    
    // Store refresh token
    await db.saveRefreshToken(req.user.id, refreshToken);
    
    // Redirect with tokens
    res.redirect(`/dashboard?token=${accessToken}&refresh=${refreshToken}`);
  }
);

// Also support traditional email/password with JWT
app.post('/auth/register', async (req, res) => {
  const { email, password } = req.body;
  
  // Create user
  const user = await createUser(email, password);
  
  // Issue JWT
  const accessToken = jwt.sign(
    { userId: user.id },
    process.env.JWT_SECRET,
    { expiresIn: '1h' }
  );
  
  res.json({ accessToken });
});

// Microservices can validate JWT independently
// Service A
app.get('/api/billing', authenticateJWT, async (req, res) => {
  const bills = await billingService.getForUser(req.user.userId);
  res.json({ bills });
});

// Service B (different server)
app.get('/api/analytics', authenticateJWT, async (req, res) => {
  const stats = await analyticsService.getForUser(req.user.userId);
  res.json({ stats });
});

// Vulnerable to XSS attacks
localStorage.setItem('token', token);

// Option 1: Store in memory (most secure, but lost on refresh)
let token = null;

// Option 2: httpOnly cookie (requires server-side change)
res.cookie('token', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
});

// Option 3: Encrypted cookie
const encryptedToken = encrypt(token);
res.cookie('token', encryptedToken);

// Long-lived access token (24 hours)
const token = jwt.sign(payload, secret, { expiresIn: '24h' });
// If compromised, valid for 24 hours!

// Short-lived access token (15 minutes)
const accessToken = jwt.sign(payload, secret, { expiresIn: '15m' });

// Long-lived refresh token (7 days, stored in database)
const refreshToken = jwt.sign(
  { userId: user.id, type: 'refresh' },
  refreshSecret,
  { expiresIn: '7d' }
);

// Store refresh token (allows revocation)
await db.saveRefreshToken(user.id, refreshToken);

app.use(session({
  secret: 'myapp', // Weak, easily guessed
}));

// Generate strong secret
const crypto = require('crypto');
const secret = crypto.randomBytes(64).toString('hex');
console.log(secret); // Store in .env

// Use in production
app.use(session({
  secret: process.env.SESSION_SECRET, // Strong, random secret
}));

const decoded = jwt.decode(token); // Only decodes, doesn't verify!

try {
  const decoded = jwt.verify(token, secret, {
    algorithms: ['HS256'], // Specify allowed algorithms
    issuer: 'myapp.com', // Validate issuer
    audience: 'myapp.com', // Validate audience
  });
  
  // Check if user still exists
  const user = await db.findUserById(decoded.userId);
  if (!user || !user.active) {
    throw new Error('User no longer valid');
  }
  
  req.user = decoded;
  next();
} catch (error) {
  res.status(401).json({ error: 'Invalid token' });
}

// No CSRF protection
app.post('/transfer-money', requireAuth, async (req, res) => {
  await transferMoney(req.session.userId, req.body.to, req.body.amount);
  res.json({ success: true });
});

const csrf = require('csurf');
const csrfProtection = csrf({ cookie: true });

// Generate token for forms
app.get('/transfer', csrfProtection, (req, res) => {
  res.render('transfer', { csrfToken: req.csrfToken() });
});

// Validate token on submission
app.post('/transfer-money', requireAuth, csrfProtection, async (req, res) => {
  await transferMoney(req.session.userId, req.body.to, req.body.amount);
  res.json({ success: true });
});

app.get('/auth/google/callback',
  passport.authenticate('google'),
  (req, res) => {
    res.redirect('/dashboard');
  }
);
// If OAuth fails, user sees error page

app.get('/auth/google/callback', (req, res, next) => {
  passport.authenticate('google', (err, user, info) => {
    if (err) {
      return res.redirect('/login?error=oauth_failed');
    }
    if (!user) {
      return res.redirect('/login?error=no_user');
    }
    
    req.logIn(user, (err) => {
      if (err) {
        return res.redirect('/login?error=login_failed');
      }
      return res.redirect('/dashboard');
    });
  })(req, res, next);
});

// Support multiple keys during rotation
const currentKey = process.env.JWT_SECRET_CURRENT;
const previousKey = process.env.JWT_SECRET_PREVIOUS;

function verifyToken(token) {
  try {
    // Try current key first
    return jwt.verify(token, currentKey);
  } catch (error) {
    // Fallback to previous key
    try {
      return jwt.verify(token, previousKey);
    } catch (fallbackError) {
      throw new Error('Invalid token');
    }
  }
}

// Rotate keys every 90 days
// 1. Generate new key
// 2. Set as JWT_SECRET_CURRENT
// 3. Move old current to JWT_SECRET_PREVIOUS
// 4. Remove old previous

// User signs up with Google OAuth
app.get('/auth/google/callback',
  passport.authenticate('google', { session: true }), // Use sessions
  (req, res) => {
    // req.user populated
    // Session created automatically
    res.redirect('/dashboard');
  }
);

// Subsequent requests use session-based auth
app.get('/api/data', requireAuth, (req, res) => {
  // req.user from session
  res.json({ data: 'protected' });
});

// OAuth for web, JWT for API/mobile
app.get('/auth/google/callback',
  passport.authenticate('google', { session: false }),
  (req, res) => {
    // Create JWT after OAuth
    const token = jwt.sign(
      { userId: req.user.id },
      process.env.JWT_SECRET,
      { expiresIn: '1h' }
    );
    
    // Web: Set cookie
    res.cookie('token', token, { httpOnly: true });
    res.redirect('/dashboard');
    
    // Mobile: Return token in response
    // res.json({ token });
  }
);

// First factor: Password
app.post('/login/password', async (req, res) => {
  const { email, password } = req.body;
  
  const user = await authenticateUser(email, password);
  if (!user) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  
  if (user.mfaEnabled) {
    // Generate temporary token for MFA step
    const mfaToken = jwt.sign(
      { userId: user.id, step: 'mfa' },
      process.env.JWT_SECRET,
      { expiresIn: '5m' } // Short-lived
    );
    
    // Send 2FA code
    await sendTOTPCode(user.email);
    
    return res.json({
      requiresMFA: true,
      mfaToken,
    });
  }
  
  // No MFA, issue regular token
  const token = jwt.sign({ userId: user.id }, process.env.JWT_SECRET);
  res.json({ token });
});

// Second factor: TOTP code
app.post('/login/mfa', async (req, res) => {
  const { mfaToken, code } = req.body;
  
  try {
    const decoded = jwt.verify(mfaToken, process.env.JWT_SECRET);
    
    if (decoded.step !== 'mfa') {
      return res.status(401).json({ error: 'Invalid token' });
    }
    
    const user = await db.findUserById(decoded.userId);
    const valid = await verifyTOTP(user.totpSecret, code);
    
    if (!valid) {
      return res.status(401).json({ error: 'Invalid code' });
    }
    
    // Issue final token
    const token = jwt.sign(
      { userId: user.id, mfaVerified: true },
      process.env.JWT_SECRET,
      { expiresIn: '24h' }
    );
    
    res.json({ token });
  } catch (error) {
    res.status(401).json({ error: 'Invalid or expired token' });
  }
});

┌────────────┐
│   Client   │
└─────┬──────┘
      │ JWT Token
      ▼
┌────────────────┐
│  API Gateway   │ ◄── Validates JWT, adds user context
└────────┬───────┘
         │
    ┌────┴────┐
    ▼         ▼
┌────────┐ ┌────────┐
│Service │ │Service │ ◄── Trust gateway, no auth needed
│   A    │ │   B    │
└────────┘ └────────┘

// API Gateway (validates JWT)
app.use('/api/*', async (req, res, next) => {
  const token = req.headers.authorization?.split(' ')[1];
  
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    
    // Add user context to headers for downstream services
    req.headers['x-user-id'] = decoded.userId;
    req.headers['x-user-role'] = decoded.role;
    
    // Forward request to appropriate service
    proxy(req, res);
  } catch (error) {
    res.status(401).json({ error: 'Unauthorized' });
  }
});

// Service A (trusts gateway)
app.get('/billing', (req, res) => {
  const userId = req.headers['x-user-id'];
  // No auth needed, gateway already validated
  const bills = getBillingForUser(userId);
  res.json({ bills });
});