OAuth & Auth Library: Authentication & Security Guide

Authentication & Security Guide A practical reference for building secure authentication with this library. JWT Best Practices Token Lifetime Use case Recommended expiry Access token 15–30 minutes Refresh token 7–14 days Password reset 10–15 minutes Email verify 24 hours Short-lived access tokens limit the blast radius if a token is leaked. Pair them with a longer-lived refresh token stored in an httpOnly cookie. Algorithm Selection HS256 — Symmetric; shared secret between issuer and verifier. Simple but the secret must never leave the server. RS256 — Asymmetric; sign with a private key, verify with a public key. Preferred when multiple services need to verify tokens independently. # Asymmetric example jwt = JWTHandler ( secret = PRIVATE_KEY_PEM , algorithm = " RS256 " , expiry_minutes = 15 , ) Claims Checklist Always include: sub — Subject (user ID or username) iat — Issued at exp — Expiration jti — Unique token ID (enables revocation) Avoid storing sensitive data (passwords, PII) in