Q50: What step-by-step security audit checklist should you follow before releasing a JWT/OAuth implementation to production?
Execute this engineering checklist to audit token authentication systems before production release:
Production Auth Security Checklist
1. Cryptographic Algorithms:
Enforce RS256/ES256 | Disable 'none'Explicitly whitelist allowed verification algorithms on all API gateways.
2. Token Lifespans:
Access Token <= 15 mins | Refresh Token RotationShort-lived access tokens limit vulnerability windows; rotation detects reuse theft.
3. Browser Token Storage:
httpOnly, Secure, SameSite=Strict CookiesIsolate tokens from JavaScript DOM execution contexts to mitigate XSS exfiltration.
4. Grant Flows:
PKCE Enforced | State Param ValidatedEliminate implicit grant types; use PKCE for SPAs and mobile apps.
Key Takeaways
- Whitelist explicit verification algorithms and enforce short access token lifespans.
- Eliminate legacy implicit grant flows in favor of Authorization Code + PKCE.