Auth in the Browser — Cheat Sheet

Session Cookies, JWTs and OAuth

# Login
session_id = secrets.token_urlsafe(32)
await redis.setex(f"session:{session_id}", 86400, json.dumps({"user_id": u.id}))
response.set_cookie("sid", session_id, httponly=True, secure=True,
                    samesite="lax", max_age=86400)

# Every request
data = await redis.get(f"session:{request.cookies['sid']}")

# Logout — genuinely gone, immediately
await redis.delete(f"session:{session_id}")

# Properties:
#   + revoke instantly, log out everywhere, change a role mid-session
#   + the cookie is opaque, so nothing leaks if it is read
#   + no size limit on what you store
#   - a lookup per request (Redis: sub-millisecond, rarely the issue)
#   - state to run and scale

# "Sessions do not scale" is repeated far more often than it is true.
# Redis handles this trivially at the size almost every product is.

Where the Credential Lives — XSS and CSRF

// localStorage
//   readable by any script on the origin — one XSS takes everything
//   survives a tab close, so a shared machine keeps the session
//   immune to CSRF, easy across origins
localStorage.setItem('token', jwt)          // convenient, and exposed

// httpOnly cookie
//   JavaScript cannot read it, so XSS cannot exfiltrate it
//   sent automatically -> needs SameSite and/or a CSRF token
Set-Cookie: sid=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=86400

// In-memory (a JS variable or React state)
//   safest against persistence — gone on refresh, which is the point
//   needs a refresh cookie to restore the session on reload
//   still readable by an XSS while the page is open

// sessionStorage
//   per-tab, cleared on close. Same XSS exposure as localStorage.

// The honest summary:
//   XSS defeats every client-side storage option. httpOnly only
//   stops the token being READ — an XSS can still make requests as
//   the user from the page itself.
//   So preventing XSS is the primary defence, and storage choice is
//   damage limitation.

Refresh Tokens, Expiry and Logout

# Access token — short, sent with every request
#   5-15 minutes. In memory on the client, or a Bearer header.
# Refresh token — long, sent only to /auth/refresh
#   7-30 days. httpOnly cookie, Path=/auth/refresh, and stored
#   server-side so it can be revoked.

@router.post("/auth/login")
async def login(body: LoginIn, response: Response):
    user = await authenticate(body.email, body.password)
    access = create_jwt(user.id, ttl=timedelta(minutes=15))
    refresh = secrets.token_urlsafe(48)
    await db.store_refresh(user.id, hash(refresh),          # HASH it —
                           expires=timedelta(days=30))       # it is a credential
    response.set_cookie("rt", refresh, httponly=True, secure=True,
                        samesite="lax", path="/auth/refresh")
    return {"access_token": access, "user": public(user)}

# Path scoping means the refresh cookie is not sent with ordinary API
# calls at all, which shrinks its exposure considerably.

# Store a hash, never the token itself — a leaked database should not
# hand over live sessions.

Authorisation — Who Enforces What

// Frontend — so users are not shown doors they cannot open
{user.role === 'admin' && <NavLink to="/admin">Admin</NavLink>}
{isPro ? <Solution /> : <UpgradePrompt />}

// Backend — so the rule is actually true
@router.delete("/problems/{slug}")
async def delete_problem(slug: str, user = Depends(require_role("admin"))):
    ...

// Skipping the frontend check: a poor experience, users hitting 403s.
// Skipping the backend check: a vulnerability.

// The two failures to internalise:
//   1. Hiding a link hides nothing. curl reaches the endpoint.
//   2. Gating in the client means the DATA was still sent. If the
//      API returns the solution and the UI hides it behind a Pro
//      gate, the solution is in the network tab.
//      Strip it server-side:
if not user.is_pro:
    problem.solution = None
    problem.hints = []

// Same for prices, other users' emails, internal notes — anything
// the response contains is public to whoever requested it.