JWT Login Flow: Access Tokens, Refresh Tokens and Rotation

App                    Auth service
 |                          |
 | POST /login              |
 | (email + password) ----> |
 | <---- access + refresh   |
 |                          |
 | GET /me                  |
 | Bearer access ---------> |
 | <---- 200                |
 |                          |
 | ... access expires ...   |
 | GET /me ---------------> |
 | <---- 401 token expired  |
 |                          |
 | POST /refresh            |
 | (refresh token) -------> |
 | <---- NEW access + NEW   |
 |       refresh; old one   |
 |       is now spent       |

import { createServer } from "node:http";
import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
import { sign, verify } from "./jwt-lib.mjs";

const SECRET = process.env.JWT_SECRET;
if (!SECRET || SECRET.length < 32) throw new Error("set JWT_SECRET to at least 32 characters");
const ACCESS_TTL = Number(process.env.ACCESS_TTL_SECONDS ?? 300);
const REFRESH_TTL = 7 * 24 * 3600;

// One demo user. Real systems store only a salted, slow hash like this one.
const salt = randomBytes(16);
const users = new Map([
  ["asha@example.test", {
    id: "usr_77", role: "member", salt,
    hash: scryptSync("correct horse battery", salt, 32),
  }],
]);

const refreshStore = new Map(); // sha256(token) -> { userId, family, used, expires }
const sha = (text) => createHash("sha256").update(text).digest("hex");
const now = () => Math.floor(Date.now() / 1000);

function issueTokens(user, family = randomBytes(8).toString("hex")) {
  const accessToken = sign(
    { sub: user.id, role: user.role, iat: now(), exp: now() + ACCESS_TTL }, SECRET);
  const refreshToken = randomBytes(32).toString("base64url"); // opaque, not a JWT
  refreshStore.set(sha(refreshToken), {
    userId: user.id, family, used: false, expires: now() + REFRESH_TTL,
  });
  return { access_token: accessToken, refresh_token: refreshToken,
           token_type: "Bearer", expires_in: ACCESS_TTL };
}

const send = (res, status, body) => {
  res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
  res.end(JSON.stringify(body));
};
const readBody = async (req) => {
  const chunks = [];
  for await (const c of req) chunks.push(c);
  try { return JSON.parse(Buffer.concat(chunks).toString() || "{}"); } catch { return {}; }
};

createServer(async (req, res) => {
  const { pathname } = new URL(req.url, "http://localhost");

  if (req.method === "POST" && pathname === "/login") {
    const { email, password } = await readBody(req);
    const user = users.get(email);
    const attempt = scryptSync(String(password ?? ""), user?.salt ?? salt, 32);
    if (!user || !timingSafeEqual(attempt, user.hash)) {
      return send(res, 401, { error: "invalid credentials" }); // same message either way
    }
    return send(res, 200, issueTokens(user));
  }

  if (req.method === "POST" && pathname === "/refresh") {
    const { refresh_token } = await readBody(req);
    const record = refreshStore.get(sha(String(refresh_token ?? "")));
    if (!record || record.expires <= now()) return send(res, 401, { error: "invalid refresh token" });
    if (record.used) {
      for (const [key, r] of refreshStore) if (r.family === record.family) refreshStore.delete(key);
      return send(res, 401, { error: "refresh token reuse detected; session revoked" });
    }
    record.used = true;
    const user = [...users.values()].find((u) => u.id === record.userId);
    return send(res, 200, issueTokens(user, record.family));
  }

  if (req.method === "GET" && pathname === "/me") {
    const match = /^Bearer (.+)$/.exec(req.headers.authorization ?? "");
    if (!match) return send(res, 401, { error: "missing bearer token" });
    try {
      const claims = verify(match[1], SECRET);
      return send(res, 200, { user: claims.sub, role: claims.role });
    } catch (err) {
      res.setHeader("www-authenticate", 'Bearer error="invalid_token"');
      return send(res, 401, { error: err.message });
    }
  }

  send(res, 404, { error: "not found" });
}).listen(Number(process.env.PORT ?? 4100), () => console.log("auth demo listening"));

const BASE = "http://localhost:4100";
const wait = (ms) => new Promise((r) => setTimeout(r, ms));

async function call(method, path, { body, token } = {}) {
  const res = await fetch(BASE + path, {
    method,
    headers: {
      ...(body ? { "content-type": "application/json" } : {}),
      ...(token ? { authorization: `Bearer ${token}` } : {}),
    },
    body: body ? JSON.stringify(body) : undefined,
  });
  return { status: res.status, json: await res.json() };
}

console.log("no token:        ", (await call("GET", "/me")).status);
const bad = await call("POST", "/login", { body: { email: "asha@example.test", password: "guess" } });
console.log("wrong password:  ", bad.status, bad.json);

const login = await call("POST", "/login", {
  body: { email: "asha@example.test", password: "correct horse battery" },
});
const first = login.json;
console.log("login:           ", login.status, Object.keys(first), "expires_in", first.expires_in);
console.log("access token:    ", first.access_token.split(".").length, "dot-separated parts");
console.log("refresh token:   ", first.refresh_token.length, "random characters, no dots");
console.log("GET /me:         ", (await call("GET", "/me", { token: first.access_token })).json);

const second = (await call("POST", "/refresh", { body: { refresh_token: first.refresh_token } })).json;
console.log("rotated:         ", second.refresh_token !== first.refresh_token);

const replay = await call("POST", "/refresh", { body: { refresh_token: first.refresh_token } });
console.log("replay old one:  ", replay.status, replay.json);
const after = await call("POST", "/refresh", { body: { refresh_token: second.refresh_token } });
console.log("newer one now:   ", after.status, after.json);

console.log("waiting for the short-lived access token to expire...");
const fresh = (await call("POST", "/login", {
  body: { email: "asha@example.test", password: "correct horse battery" },
})).json;
await wait(3000);
console.log("expired access:  ", (await call("GET", "/me", { token: fresh.access_token })).json);

no token:         401
wrong password:   401 { error: 'invalid credentials' }
login:            200 [ 'access_token', 'refresh_token', 'token_type', 'expires_in' ] expires_in 2
access token:     3 dot-separated parts
refresh token:    43 random characters, no dots
GET /me:          { user: 'usr_77', role: 'member' }
rotated:          true
replay old one:   401 { error: 'refresh token reuse detected; session revoked' }
newer one now:    401 { error: 'invalid refresh token' }
waiting for the short-lived access token to expire...
expired access:   { error: 'token expired' }

curl -s -i http://localhost:4100/me -H "Authorization: Bearer not-a-real-token"

HTTP/1.1 401 Unauthorized
www-authenticate: Bearer error="invalid_token"
content-type: application/json
cache-control: no-store
Transfer-Encoding: chunked

{"error":"malformed token"}