import jwt, { JwtPayload, SignOptions } from 'jsonwebtoken';
const SECRET = process.env.JWT_SECRET as string;
const ISSUER = 'auth.example.com';
const AUDIENCE = 'api.example.com';
export interface AccessClaims {
sub: string;
role: string;
}
export class TokenError extends Error {}
export function signAccessToken(claims: AccessClaims): string {
const options: SignOptions = {
expiresIn: '15m',
issuer: ISSUER,
audience: AUDIENCE,
};
return jwt.sign({ ...claims, type: 'access' }, SECRET, options);
}
export function verifyAccessToken(token: string): AccessClaims {
let payload: string | JwtPayload;
try {
payload = jwt.verify(token, SECRET, { issuer: ISSUER, audience: AUDIENCE });
} catch (err) {
throw new TokenError('invalid or expired token');
}
if (typeof payload === 'string' || payload.type !== 'access') {
throw new TokenError('token is not an access token');
}
return { sub: String(payload.sub), role: String(payload.role) };
}
import { Request, Response, NextFunction } from 'express';
import { verifyAccessToken, TokenError, AccessClaims } from './tokenService';
declare global {
namespace Express {
interface Request {
user?: AccessClaims;
}
}
}
export function authenticate(req: Request, res: Response, next: NextFunction): void {
const header = req.headers.authorization ?? '';
const [scheme, token] = header.split(' ');
if (scheme !== 'Bearer' || !token) {
res.status(401).json({ error: 'missing bearer token' });
return;
}
try {
req.user = verifyAccessToken(token);
next();
} catch (err) {
if (err instanceof TokenError) {
res.status(401).json({ error: err.message });
return;
}
next(err);
}
}
export function requireRole(...roles: string[]) {
return (req: Request, res: Response, next: NextFunction): void => {
if (!req.user) {
res.status(401).json({ error: 'not authenticated' });
return;
}
if (!roles.includes(req.user.role)) {
res.status(403).json({ error: 'insufficient permissions' });
return;
}
next();
};
}
import { Router, Request, Response } from 'express';
import { signAccessToken } from './tokenService';
import { authenticate, requireRole } from './authMiddleware';
import { findUserByEmail, verifyPassword } from './userStore';
const router = Router();
router.post('/login', async (req: Request, res: Response) => {
const { email, password } = req.body ?? {};
const user = await findUserByEmail(email);
if (!user || !(await verifyPassword(user, password))) {
return res.status(401).json({ error: 'invalid credentials' });
}
const accessToken = signAccessToken({ sub: user.id, role: user.role });
return res.json({ accessToken, tokenType: 'Bearer', expiresIn: 900 });
});
router.get('/me', authenticate, (req: Request, res: Response) => {
res.json({ id: req.user!.sub, role: req.user!.role });
});
router.delete('/users/:id', authenticate, requireRole('admin'), (req, res) => {
res.json({ deleted: req.params.id, by: req.user!.sub });
});
export default router;
This snippet shows how short-lived JWT access tokens are issued and validated in an Express API, split cleanly between a token service that owns the crypto and middleware that enforces it on routes. The separation matters: the signing/verifying logic should live in one place so key rotation, clock skew, and claim conventions are consistent everywhere, while route handlers stay thin.
In tokenService.ts, signAccessToken embeds only the minimal claims needed downstream — a stable subject (sub), a role, and a type marker — plus a short expiresIn. The explicit type: 'access' claim is a small but important defense: it prevents a refresh token from being accepted where an access token is expected, which is a common privilege-escalation mistake when both are signed with the same secret. verifyAccessToken wraps jwt.verify and enforces the issuer and audience, so a valid token minted for a different service is rejected. Errors from jsonwebtoken (expiry, bad signature, malformed input) are normalized into a single TokenError so callers do not have to pattern-match on library internals.
The authenticate middleware in authMiddleware.ts pulls the bearer token from the Authorization header, verifies it, and attaches a typed req.user. Because it never throws, it forwards failures to Express's error pipeline via next with the right 401 semantics. The companion requireRole is a higher-order middleware — it returns a middleware configured with the allowed roles — which keeps authorization declarative at the route level. Splitting authentication (who are you) from authorization (what may you do) is deliberate: the token can be valid while the role is still insufficient, and those map to 401 versus 403 respectively.
The Express type augmentation for Request gives req.user real types across the app instead of casting in every handler. authRoutes.ts ties it together: a login route calls signAccessToken after credential checks, and a protected route composes authenticate with requireRole('admin'). The trade-off of stateless JWTs is that they cannot be revoked before expiry, which is why the access token lifetime is kept short and paired with a separately managed refresh flow. Keeping the secret in env and validating issuer/audience are the guardrails that make this pattern safe in practice.
Related snips
payload = {
sub: user.id,
iss: 'https://auth.example.com',
aud: 'codesnips-api',
exp: 15.minutes.from_now.to_i,
iat: Time.now.to_i,JWT issuance and verification without common footguns
module Api
module V1
class UsersController < BaseController
def show
user = User.includes(:profile).find(params[:id])ETags for conditional requests and caching
type User {
id: ID!
name: String!
email: String!
posts: [Post!]!
createdAt: String!GraphQL API with Spring Boot
export type Settled<R> =
| { status: 'fulfilled'; value: R }
| { status: 'rejected'; reason: unknown };
export interface ConcurrencyOptions {
limit: number;Simple concurrency limiter for batch operations
#!/usr/bin/env bash
set -euo pipefail
export VAULT_ADDR="https://vault.internal:8200"
export VAULT_TOKEN="${VAULT_TOKEN:?missing VAULT_TOKEN}"Secrets management with environment isolation and Vault
import axios, { AxiosError } from 'axios'
import { v4 as uuidv4 } from 'uuid'
const api = axios.create({
baseURL: import.meta.env.VITE_API_URL || 'http://localhost:3000/api/v1',
timeout: 15000,Axios API client with interceptors
Share this code
Here's the card — post it anywhere.
