Windsurf prompt to add JWT authentication
Auth is the wrong place to improvise, so this prompt pins the design: argon2 or bcrypt hashing, short-lived access tokens, rotating refresh cookies, and hashed token storage with revocation. Cascade writes the four endpoints and the middleware, then runs the full login cycle as integration tests inside Windsurf before you see the diff.
Last updated
Add JWT authentication to this API. Endpoints: POST /auth/register hashing passwords with argon2 or bcrypt, POST /auth/login returning a short-lived access token plus an httpOnly refresh cookie, POST /auth/refresh rotating the refresh token, POST /auth/logout revoking it. Store refresh token hashes in {{database}} with a revoked flag; never store raw tokens. Sign with a secret read from env and fail startup loudly when it is missing. Middleware attaches req.user, returns 401 for expired tokens and 403 for valid but forbidden ones. Handle replayed refresh tokens, clock skew tolerance, and login rate limiting. Write integration tests covering the full register, login, refresh, logout cycle, run them in the Windsurf terminal, and show me the combined diff with the test output.Customize it
Runs in your browser. Nothing you type here is sent anywhere.
Add JWT authentication to this API. Endpoints: POST /auth/register hashing passwords with argon2 or bcrypt, POST /auth/login returning a short-lived access token plus an httpOnly refresh cookie, POST /auth/refresh rotating the refresh token, POST /auth/logout revoking it. Store refresh token hashes in PostgreSQL with a revoked flag; never store raw tokens. Sign with a secret read from env and fail startup loudly when it is missing. Middleware attaches req.user, returns 401 for expired tokens and 403 for valid but forbidden ones. Handle replayed refresh tokens, clock skew tolerance, and login rate limiting. Write integration tests covering the full register, login, refresh, logout cycle, run them in the Windsurf terminal, and show me the combined diff with the test output.
Same task in other tools
Questions about this prompt
Does Cascade get the token rotation logic right?
It implements what the prompt specifies, which is why the replayed-refresh-token case is called out explicitly. Read the refresh handler's diff closely; rotation without replay detection is the classic silent gap.
How do I adapt this to an existing user table?
Point the register endpoint at your current model and tell Cascade which password column and hashing scheme are already in place. If you want hashes upgraded lazily on next login, say so; it changes the login handler.
Logins work locally but every deployed request returns 401. Why?
Usually the signing secret differs between environments, or the cookie lacks the secure and sameSite flags your domain setup needs. The fail-loudly-on-missing-secret rule catches half of this at startup; check cookie flags for the rest.