Authentication Cheat Sheet

How to use this Authentication cheat sheet

Session auth stores server-side state with a session ID in an HttpOnly cookie. JWTs embed claims signed by the server; access tokens are short-lived with refresh tokens rotated in secure storage. Cookie flags Secure, HttpOnly, and SameSite reduce XSS and CSRF risk.

OAuth 2.0 delegates login to providers (Google, GitHub) via authorization code flow with PKCE for SPAs. CSRF tokens protect cookie-based forms. Passwords use bcrypt or Argon2 with per-user salt; never roll your own crypto.

Quick Authentication example

// Set session cookie after login
res.cookie('sessionId', session.id, {
  httpOnly: true,
  secure: true,
  sameSite: 'lax',
  maxAge: 24 * 60 * 60 * 1000,
  path: '/',
});

// Verify JWT access token
const payload = jwt.verify(token, process.env.JWT_SECRET, {
  algorithms: ['HS256'],
  issuer: 'https://api.example.com',
});

Sessions vs JWT

Cookie Flags & CSRF

OAuth & Password Hashing

Refresh Tokens & Token Rotation

OAuth 2.0 authorization code with PKCE

const verifier = base64url(crypto.randomBytes(32));
const challenge = base64url(sha256(verifier));
const authUrl = new URL('https://provider/oauth/authorize');
authUrl.searchParams.set('response_type', 'code');
authUrl.searchParams.set('client_id', CLIENT_ID);
authUrl.searchParams.set('redirect_uri', REDIRECT_URI);
authUrl.searchParams.set('code_challenge', challenge);
authUrl.searchParams.set('code_challenge_method', 'S256');
authUrl.searchParams.set('state', randomState);

Exchange code server-side with code_verifier; never expose client secret in SPA.

bcrypt password verify

import bcrypt from 'bcrypt';

const hash = await bcrypt.hash(password, 12);
const ok = await bcrypt.compare(loginPassword, storedHash);
if (!ok) throw new UnauthorizedError();

Store only hash; use constant-time compare built into bcrypt.compare.

CSRF middleware pattern (Express)

import csrf from 'csurf';
const csrfProtection = csrf({ cookie: { httpOnly: true, sameSite: 'strict' } });

app.get('/form', csrfProtection, (req, res) => {
  res.render('form', { csrfToken: req.csrfToken() });
});
app.post('/form', csrfProtection, handler);

Pair CSRF tokens with SameSite cookies for defense in depth.

Common mistakes

• Storing JWTs in localStorage where any XSS script can exfiltrate them.
• Using SameSite=None without Secure flag on cookies.
• Skipping PKCE on SPA OAuth flows because the client is public.
• Storing passwords with fast hashes (SHA256) instead of bcrypt/Argon2.

Key takeaways

• Sessions for traditional apps; short-lived JWTs plus refresh for APIs.
• HttpOnly, Secure, SameSite cookies and CSRF tokens protect cookie-based auth.
• OAuth authorization code with PKCE for third-party login in browsers.
• Hash passwords with bcrypt/Argon2; rotate refresh tokens and detect reuse.