📄PR Description
What’s new?
Introduces JWT-based authentication for EduBridge.
Adds secure password hashing with bcrypt.
Implements token expiry (15m access tokens, 7d refresh tokens).
Provides logout and refresh endpoints for session management.
Why this matters
Security: Eliminates plaintext password storage in localStorage.
Resilience: Protects against XSS and console-based bypass attacks.
Industry standard: Aligns with modern practices (Firebase, Auth0).
Scalability: Enables server-side validation and session expiry.
Implementation details
Backend (Flask):
POST /auth/login → issues access + refresh tokens.
POST /auth/refresh → rotates refresh tokens.
POST /auth/logout → invalidates refresh tokens.
Libraries:
bcrypt for password hashing.
PyJWT for token signing.
Flask-JWT-Extended for middleware support.
Flow:
Access token expires in 15 minutes.
Refresh token expires in 7 days.
Tokens stored securely in HTTP-only cookies.
Testing notes
Verified login, refresh, and logout flows.
Checked token expiry and rotation handling.
Ensured secure cookie flags (httpOnly, sameSite, secure).
📄PR Description
What’s new?
Introduces JWT-based authentication for EduBridge.
Adds secure password hashing with bcrypt.
Implements token expiry (15m access tokens, 7d refresh tokens).
Provides logout and refresh endpoints for session management.
Why this matters
Security: Eliminates plaintext password storage in localStorage.
Resilience: Protects against XSS and console-based bypass attacks.
Industry standard: Aligns with modern practices (Firebase, Auth0).
Scalability: Enables server-side validation and session expiry.
Implementation details
Backend (Flask):
POST /auth/login → issues access + refresh tokens.
POST /auth/refresh → rotates refresh tokens.
POST /auth/logout → invalidates refresh tokens.
Libraries:
bcrypt for password hashing.
PyJWT for token signing.
Flask-JWT-Extended for middleware support.
Flow:
Access token expires in 15 minutes.
Refresh token expires in 7 days.
Tokens stored securely in HTTP-only cookies.
Testing notes
Verified login, refresh, and logout flows.
Checked token expiry and rotation handling.
Ensured secure cookie flags (httpOnly, sameSite, secure).