Claude Code prompt to add JWT authentication
Auth bugs hide in the paths nobody exercises by hand: expired tokens, tampered signatures, replayed refresh tokens. This prompt has Claude Code enumerate the routes it will protect before writing middleware, then demonstrate the finished flow with three curl calls against the running server, so review starts from observed behavior rather than assumed behavior.
Last updated
Add JWT authentication to the existing API in this repo. Read the current route structure first and tell me which routes you will protect before touching code. Implement: a login endpoint that verifies credentials against {{database}} and returns a short-lived access token plus a rotating refresh token stored server-side, middleware that validates signature, expiry, and audience on protected routes, and a logout that revokes the refresh token. Sign with an algorithm read from config, key from an environment variable; refuse to start if the variable is missing. Never log tokens. Write tests for: expired token rejected, tampered signature rejected, refresh rotation invalidates the old refresh token, and logout blocks reuse. Run the suite, then hit a protected route with curl three ways, no token, bad token, fresh token, and paste all three responses.Customize it
Runs in your browser. Nothing you type here is sent anywhere.
Add JWT authentication to the existing API in this repo. Read the current route structure first and tell me which routes you will protect before touching code. Implement: a login endpoint that verifies credentials against PostgreSQL and returns a short-lived access token plus a rotating refresh token stored server-side, middleware that validates signature, expiry, and audience on protected routes, and a logout that revokes the refresh token. Sign with an algorithm read from config, key from an environment variable; refuse to start if the variable is missing. Never log tokens. Write tests for: expired token rejected, tampered signature rejected, refresh rotation invalidates the old refresh token, and logout blocks reuse. Run the suite, then hit a protected route with curl three ways, no token, bad token, fresh token, and paste all three responses.
Same task in other tools
Questions about this prompt
Why rotate refresh tokens instead of issuing long-lived access tokens?
Revocation. A refresh token stored server-side can be killed at logout or on suspicion of theft; a long-lived access token cannot be recalled. The test that logout blocks reuse encodes exactly that property.
A browser SPA and a mobile client share this API. What changes?
Transport, not validation. Tell Claude Code to deliver tokens to browsers in httpOnly cookies and to mobile in the response body; the middleware checking signature, expiry, and audience stays identical for both.
What is the most common way this goes wrong?
A fallback signing secret hardcoded for developer convenience that quietly ships. The refuse-to-start rule blocks it; verify by unsetting the environment variable yourself and confirming the process exits with the missing-key error.