HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

Untitled Lesson

⚡ Total XP: 0|💻 backend XP: 0

Skill Matrix

UNLOCK NODES BY LEARNING NEW TAGS.

Select an unlocked node to view details root

Pascual Vila

Frontend Instructor // Code Syllabus

Common Pitfalls & Errors

The Error //

Storing sensitive data or long-lived secrets inside the JWT payload

// Wrong: payload is readable by anyone with the token
const token = jwt.sign({ id: user.id, password: user.plainPassword }, SECRET);

// Correct: only non-sensitive claims
const token = jwt.sign({ id: user.id, role: user.role }, SECRET, { expiresIn: '15m' });

The Solution //

The JWT payload is only Base64-encoded, not encrypted — anyone who intercepts the token (browser devtools, a proxy, a compromised extension) can decode and read every field instantly. Never put passwords, credit card data, or anything meant to stay private in the payload; keep it to non-sensitive identifiers like a user ID and role, and put anything sensitive in a database lookup instead.

The Error //

Storing the refresh token in localStorage instead of an HttpOnly cookie

// Wrong: readable by any injected script
localStorage.setItem('refreshToken', token);

// Correct: inaccessible to JavaScript
res.cookie('refresh', refreshToken, { httpOnly: true, secure: true, sameSite: 'strict' });

The Solution //

A refresh token readable by JavaScript (localStorage/sessionStorage) is fully exposed to any XSS vulnerability on the page, letting an attacker mint fresh access tokens indefinitely. Issue refresh tokens as HttpOnly, Secure, SameSite cookies so client-side JavaScript can never read them, and keep only the short-lived access token in memory.