SECURITY2 Multi-file Components

JWT Authentication Security & Refresh Token Rotator

Best practices for implementing secure JSON Web Token authentication resistant to XSS and token replay attacks.

Author: TRIHEX Architecture Lab

•

License: MIT

•

Version: 2.1.0

Inert Code Verified · Heuristic Static Security ScannerHeuristic Scanner: LOW Risk

Heuristic static security scanner audited 2 files (2520 bytes). External code. Review before execution.

v2.1.0

Skill Files (2)

Compatible Runtimes

AntigravityClaude CodeCursor

SKILL.md·markdown

# JWT Authentication Security & Refresh Token Rotator

HttpOnly cookie tokens, asymmetric RS256/EdDSA signing, automatic refresh rotation, and token family revoking.

## Core Invariants & Rules
1. Store JWTs in HttpOnly, Secure, SameSite=Lax cookies. Never in localStorage.
2. Verify input validation and security boundaries on all executions.
3. Keep configurations modular, typed, and auditable.

## Operational Workflow
1. Analyze requirements against existing codebase patterns.
2. Apply standardized implementation templates.
3. Execute verification suites before deployment.