NestJS Zero to Hero 11 — Authentication, JWT và Refresh Token Rotation
Xây password login an toàn, access JWT có issuer/audience, global Passport guard, refresh session rotation/reuse detection và logout/revoke có state.
Filter/Tag
#jwt
3 entries
-
-
Web Security for Frontend Devs · Part 15 — JWT & Token Attacks
Advanced track: JWT attacks to recognize — alg:none, RS256→HS256 confusion, weak HMAC secrets, kid/jku injection, unchecked exp/aud/iss — why the browser must never trust a claim. With a forge/verify simulator and exercises.
-
Node.js Production Engineering 15 — Identity Architecture với JWT và OIDC
Thiết kế identity cho Node.js production: threat model, JWT validation, access/refresh token, atomic token-family rotation đa thiết bị, cookie/BFF, OIDC Authorization Code với state, nonce, PKCE và authorization theo resource.