User Login & JWT Authentication Security System

What began as a user login requirement was developed into a reusable authentication and identity system for modern web applications. The platform manages the complete authentication lifecycle, including registration, email verification, verified-user login, logout, access-token renewal, password reset, password changes, and recovery for users who registered but did not complete verification.

Rather than tying authentication to a single application, the system was designed as a reusable foundation that can be adapted to SaaS products, e-commerce platforms, CRM systems, internal business applications, and other authenticated web platforms.

The authentication system was upgraded from symmetric HS256 signing to RS256 asymmetric cryptography using 3072-bit RSA keys. Separate keysets are maintained for access, refresh, and action tokens, with kid identifiers, rotation-ready key management, strict algorithm verification, and issuer and audience validation.

A JWKS endpoint exposes only the public keys required to verify access tokens, while refresh-token and action-token signing infrastructure remains private. Previous verification keys can also be retained during rotation so existing valid tokens continue to verify safely until expiration.

The system uses PostgreSQL-backed refresh sessions with HttpOnly cookies, hashed refresh tokens, random jti identifiers, token revocation, single-use refresh rotation, and transactional successor-token handling. This keeps long-lived authentication state controlled by the backend rather than storing JWTs in browser localStorage or sessionStorage.

Multi-tab authentication is coordinated using BroadcastChannel and Web Locks. A bounded race-recovery mechanism safely handles legitimate simultaneous refresh requests without reactivating revoked tokens or weakening refresh-token security.

The system includes a separate Master Admin authentication architecture with dedicated database records and refresh-session handling. Role-aware routing prevents normal users from accessing administrative routes while keeping Master Admin authentication isolated from standard user sessions.

Cross-role navigation is handled without unnecessarily destroying valid sessions, while unauthorized requests are redirected to the appropriate authenticated area. The Master Admin account and its sessions are also explicitly protected from the automated public demo-user cleanup process.

Security was implemented across multiple layers rather than relying on JWT authentication alone. The system combines route-specific rate limiting, CSRF protection, origin-restricted CORS, secure production cookies, browser security headers, controlled proxy trust, and HTTPS/HSTS protection at the Nginx edge.

Production infrastructure was further hardened through non-root container execution, dropped Linux capabilities, no-new-privileges, read-only RSA private-key mounts, and separation of cryptographic keys from both Git and Docker images.

The authentication system was deployed as an isolated production application on a Linux VPS using Docker, Docker Compose, Nginx, HTTPS, PostgreSQL, and explicit database migrations. Production containers run as a dedicated non-root user, while cryptographic keys remain outside the source repository and Docker images and are mounted read-only at runtime.

The system was validated through automated regression tests and live production testing covering registration, verification, login, password recovery, multi-tab sessions, rapid refresh, role isolation, RS256/JWKS verification, migrations, and deployment. Backend automated coverage reached 66 passing tests, while the public demo uses an automated 24-hour lifecycle that removes temporary user accounts and associated sessions/tokens without affecting Master Admin data.