GitHub Copilot prompt to add JWT authentication
Auth code fails quietly, which is the worst way for it to fail. This prompt has GitHub Copilot find your routes and user model first, then add login, refresh rotation, and a guard middleware with startup-time secret checks, finishing with a three-call curl sequence that proves tampered tokens get rejected.
Last updated
Add JWT authentication to this API. Use @workspace to locate the route registration file and the user model backed by {{database}} before touching anything. Implement POST /auth/login, verifying the password with the hashing library already in package.json, and POST /auth/refresh, which rotates a refresh token stored as an httpOnly, Secure, SameSite strict cookie. Access tokens live fifteen minutes, carry sub and role claims only, and are signed with a secret read from the environment, fail startup if it is missing rather than defaulting. Write middleware/requireAuth that returns 401 for absent or expired tokens and 403 when a role guard fails, with distinct machine-readable error codes. Do not store tokens in localStorage anywhere. List every changed file when done. I will verify with three curl calls: login, a protected route with the token, and the same route after tampering with one signature character, expecting 200, 200, 401.Customize it
Runs in your browser. Nothing you type here is sent anywhere.
Add JWT authentication to this API. Use @workspace to locate the route registration file and the user model backed by PostgreSQL before touching anything. Implement POST /auth/login, verifying the password with the hashing library already in package.json, and POST /auth/refresh, which rotates a refresh token stored as an httpOnly, Secure, SameSite strict cookie. Access tokens live fifteen minutes, carry sub and role claims only, and are signed with a secret read from the environment, fail startup if it is missing rather than defaulting. Write middleware/requireAuth that returns 401 for absent or expired tokens and 403 when a role guard fails, with distinct machine-readable error codes. Do not store tokens in localStorage anywhere. List every changed file when done. I will verify with three curl calls: login, a protected route with the token, and the same route after tampering with one signature character, expecting 200, 200, 401.
Same task in other tools
Questions about this prompt
Why insist on distinct error codes for 401 and 403?
Clients handle them differently: an expired token should trigger a refresh and retry, a role failure should not retry at all. Machine-readable codes turn that into a switch statement instead of string matching.
What changes if my frontend runs on a different origin?
The refresh cookie needs SameSite None with Secure, and CORS must allow the exact origin with credentials enabled. A wildcard origin will silently break cookie auth in every browser.
Copilot added a fallback secret so the server boots without config. Is that fine?
No, that default will pass local testing and reach production. Keep the fail-at-startup rule and search the codebase for the secret's variable name to confirm it is read in exactly one place.