Cursor prompt to add JWT authentication
Bolting auth onto an API involves a dozen small decisions that are easy to get wrong, so this prompt makes them explicit: hashed passwords, short-lived access tokens, httpOnly refresh cookies with rotation, and correct 401 semantics. Cursor's agent adds the endpoints and middleware to your existing API and proves the edge cases with tests.
Last updated
Add JWT authentication to the existing API in this repo. Create POST /auth/register and POST /auth/login endpoints that hash passwords with bcrypt or argon2, never plaintext, then issue a short-lived access token (15 minutes) and a refresh token (7 days) stored as an httpOnly, Secure, SameSite=Strict cookie. Add middleware that verifies the access token signature and expiry, attaches the user to the request, and returns 401 with a WWW-Authenticate header on failure rather than 500. Include POST /auth/refresh with refresh token rotation and a revocation check against {{database}}. Read the signing secret from an environment variable and fail fast at startup if it is missing. Cover expired tokens, tampered signatures, and reuse of a rotated refresh token in tests, run them, and list changed files.Customize it
Runs in your browser. Nothing you type here is sent anywhere.
Add JWT authentication to the existing API in this repo. Create POST /auth/register and POST /auth/login endpoints that hash passwords with bcrypt or argon2, never plaintext, then issue a short-lived access token (15 minutes) and a refresh token (7 days) stored as an httpOnly, Secure, SameSite=Strict cookie. Add middleware that verifies the access token signature and expiry, attaches the user to the request, and returns 401 with a WWW-Authenticate header on failure rather than 500. Include POST /auth/refresh with refresh token rotation and a revocation check against PostgreSQL. Read the signing secret from an environment variable and fail fast at startup if it is missing. Cover expired tokens, tampered signatures, and reuse of a rotated refresh token in tests, run them, and list changed files.
Same task in other tools
Questions about this prompt
Can I use this with a library like Passport or NextAuth instead of hand-rolled JWT handling?
Yes. Swap the middleware instructions for "integrate NextAuth" or your library of choice, and keep the cookie, rotation, and revocation requirements as acceptance criteria. Cursor then maps those requirements onto the library's configuration rather than writing raw token code.
Why refresh token rotation instead of one long-lived token?
Rotation means each refresh token works exactly once, so a stolen token dies the moment the legitimate client refreshes, and any reuse becomes a detectable signal worth logging. The prompt makes the agent test that reuse case because it is the part most implementations forget.
The agent hardcoded a fallback secret when the env var was missing. How do I stop that?
A default value subverts the fail-fast requirement, so reject the diff and point at that line of the prompt. Saying "throw on missing JWT_SECRET at boot, no fallback value" removes the ambiguity that lets the model add one.