ruby 22 lines · 2 tabs

JWT issuance and verification without common footguns

Kai Nakamura Apr 2026

2 tabs

payload = {
  sub: user.id,
  iss: 'https://auth.example.com',
  aud: 'codesnips-api',
  exp: 15.minutes.from_now.to_i,
  iat: Time.now.to_i,
  jti: SecureRandom.uuid,
}

token = JWT.encode(payload, OpenSSL::PKey::RSA.new(ENV.fetch('JWT_PRIVATE_KEY')), 'RS256')

decoded, = JWT.decode(
  token,
  OpenSSL::PKey::RSA.new(ENV.fetch('JWT_PUBLIC_KEY')),
  true,
  algorithm: 'RS256',
  iss: 'https://auth.example.com',
  verify_iss: true,
  aud: 'codesnips-api',
  verify_aud: true,
)

raise SecurityError, 'expired token' if decoded['exp'] < Time.now.to_i

2 files · ruby Explain with highlit

JWTs are easy to misuse because libraries make them look simpler than they are. I pin the algorithm, validate issuer and audience, keep expirations short, and rotate signing keys deliberately. I also avoid putting sensitive business data into tokens just because it is convenient.

Related snips

ruby

module Api
  module V1
    class UsersController < BaseController
      def show
        user = User.includes(:profile).find(params[:id])

ETags for conditional requests and caching

rails caching http-caching

by Alex Kumar 1 tab

graphql

type User {
    id: ID!
    name: String!
    email: String!
    posts: [Post!]!
    createdAt: String!

GraphQL API with Spring Boot

java graphql spring-boot

by David Kumar 3 tabs

bash

#!/usr/bin/env bash
set -euo pipefail

export VAULT_ADDR="https://vault.internal:8200"
export VAULT_TOKEN="${VAULT_TOKEN:?missing VAULT_TOKEN}"

Secrets management with environment isolation and Vault

secrets-management vault environment-variables

by Kai Nakamura 1 tab

typescript

import axios, { AxiosError } from 'axios'
import { v4 as uuidv4 } from 'uuid'

const api = axios.create({
  baseURL: import.meta.env.VITE_API_URL || 'http://localhost:3000/api/v1',
  timeout: 15000,

Axios API client with interceptors

react axios api

by Maya Patel 1 tab

typescript

import { randomBytes, createHash } from "crypto";
import jwt from "jsonwebtoken";
import { RefreshTokenStore } from "./store";

const ACCESS_SECRET = process.env.ACCESS_SECRET!;
const ACCESS_TTL = "15m";

JWT access + refresh token rotation (conceptual)

security node jwt

by codesnips 3 tabs

python

import graphene
from graphene_django import DjangoObjectType
from blog.models import Post, Comment


class PostType(DjangoObjectType):

Django GraphQL with Graphene

django python graphql

by Priya Sharma 2 tabs

Share this code

Here's the card — post it anywhere.

JWT issuance and verification without common footguns — share card

Link copied