Generate a JWT Secret — Free HS256/384/512 Key Generator

// middleware/auth.js
const jwt = require('jsonwebtoken');
const rateLimit = require('express-rate-limit');

// Throttling for auth endpoints — 5 attempts per 15 minutes
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many login attempts'
});

class JWTService {
  constructor() {
    this.secret = process.env.JWT_SECRET;
    this.algorithm = 'HS256';
    if (!this.secret) {
      throw new Error('JWT_SECRET config variable is required');
    }
  }

  generateToken(payload) {
    return jwt.sign(
      {
        ...payload,
        iat: Math.floor(Date.now() / 1000),
        jti: require('crypto').randomBytes(16).toString('hex')
      },
      this.secret,
      {
        algorithm: this.algorithm,
        expiresIn: '24h',
        issuer: 'your-app',
        audience: 'your-users'
      }
    );
  }

  verifyToken(token) {
    try {
      return jwt.verify(token, this.secret, {
        algorithms: [this.algorithm], // Always specify explicitly
        issuer: 'your-app',
        audience: 'your-users'
      });
    } catch (error) {
      if (error.name === 'TokenExpiredError') {
        throw new Error('ExpiredSignatureError: token has expired');
      }
      throw new Error('InvalidTokenError: ' + error.message);
    }
  }
}

// Request handler — extracts Bearer token from Authorization header
const authenticateToken = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (!token) {
    return res.status(401).json({ error: 'Access token required' });
  }

  try {
    const jwtService = new JWTService();
    req.user = jwtService.verifyToken(token);
    next();
  } catch (error) {
    return res.status(403).json({ error: 'Invalid token' });
  }
};

module.exports = { authenticateToken, authLimiter };

# jwt_auth.py
import jwt
import os
from datetime import datetime, timedelta, timezone
from functools import wraps
from flask import request, jsonify

class JWTAuth:
    def __init__(self):
        self.secret = os.getenv('JWT_SECRET')  # Never hardcode
        self.algorithm = 'HS256'
        if not self.secret:
            raise ValueError('JWT_SECRET config variable required')

    def generate_token(self, user_data):
        payload = {
            'user_id': user_data['id'],
            'email': user_data['email'],
            'role': user_data.get('role', 'user'),
            'scope': user_data.get('scope', 'read'),
            'exp': datetime.now(timezone.utc) + timedelta(hours=24),
            'iat': datetime.now(timezone.utc),
            'iss': 'your-app',    # iss claim
            'aud': 'your-users',  # aud claim
            'sub': str(user_data['id'])  # sub claim
        }
        return jwt.encode(payload, self.secret, algorithm=self.algorithm)

    def verify_token(self, token):
        try:
            return jwt.decode(
                token,
                self.secret,
                algorithms=[self.algorithm],  # Explicitly specified — never omit
                options={"verify_aud": True, "verify_iss": True}
            )
        except jwt.ExpiredSignatureError:
            raise ValueError('Token has expired')
        except jwt.InvalidTokenError as e:
            raise ValueError('Invalid token: ' + str(e))

# Decorator for flask — protects routes requiring a valid token
def token_required(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        auth_header = request.headers.get('Authorization')
        if not auth_header:
            return jsonify({'error': 'Token missing'}), 401
        try:
            token = auth_header.split(' ')[1]  # Strip 'Bearer '
            jwt_auth = JWTAuth()
            payload = jwt_auth.verify_token(token)
            request.current_user = payload
        except (IndexError, ValueError) as e:
            return jsonify({'error': str(e)}), 401
        return f(*args, **kwargs)
    return decorated

// middleware/jwt_middleware.go
package middleware

import (
    "net/http"
    "os"
    "strings"
    "time"

    "github.com/gin-gonic/gin"
    "github.com/golang-jwt/jwt/v4"
)

var jwtSecret = []byte(os.Getenv("JWT_SECRET")) // Load from config variable

type Claims struct {
    UserID string `json:"user_id"`
    Role   string `json:"role"`
    Email  string `json:"email"`   // email claim
    Scope  string `json:"scope"`   // scope claim
    jwt.RegisteredClaims
}

func GenerateToken(userID, role, email string) (string, error) {
    claims := Claims{
        UserID: userID,
        Role:   role,   // role claim
        Email:  email,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),
            IssuedAt:  jwt.NewNumericDate(time.Now()),
            Issuer:    "your-app",  // issuer claim
            Subject:   userID,      // sub claim
            Audience:  jwt.ClaimStrings{"your-api"}, // audience claim
        },
    }
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
    return token.SignedString(jwtSecret)
}

func AuthMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        authHeader := c.GetHeader("Authorization")
        if authHeader == "" {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Authorization header required"})
            c.Abort()
            return
        }

        tokenString := strings.TrimPrefix(authHeader, "Bearer ")
        claims := &Claims{}

        token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
            // Validate signing method — prevents algorithm confusion attacks
            if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
                return nil, jwt.ErrSignatureInvalid
            }
            return jwtSecret, nil
        })

        if err != nil || !token.Valid {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token"})
            c.Abort()
            return
        }

        c.Set("userID", claims.UserID)
        c.Set("role", claims.Role)
        c.Next()
    }
}

// JwtUtil.java
import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

@Component
public class JwtUtil {

    @Value("${JWT_SECRET}")  // Injected from config variable
    private String jwtSecret;

    private final int jwtExpirationMs = 86400000; // 24 hours

    public String generateToken(String userId, String role) {
        return Jwts.builder()
            .setSubject(userId)
            .claim("role", role)
            .setIssuer("your-app")
            .setAudience("your-api")
            .setIssuedAt(new java.util.Date())
            .setExpiration(new java.util.Date(System.currentTimeMillis() + jwtExpirationMs))
            .signWith(Keys.hmacShaKeyFor(jwtSecret.getBytes()), SignatureAlgorithm.HS256)
            .compact();
    }

    public Claims extractClaims(String token) {
        try {
            return Jwts.parserBuilder()
                .setSigningKey(Keys.hmacShaKeyFor(jwtSecret.getBytes()))
                .build()
                .parseClaimsJws(token)
                .getBody();
        } catch (JwtException e) {
            throw new RuntimeException("Token validation failed: " + e.getMessage());
        }
    }

    public boolean validateToken(String token) {
        try { extractClaims(token); return true; }
        catch (JwtException | IllegalArgumentException e) { return false; }
    }
}

<?php
namespace App\Helpers;

use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Exception;

class JwtHelper {
    private static $secret;    // Loaded from env('JWT_SECRET')
    private static $algorithm = 'HS256';

    public static function init() {
        self::$secret = env('JWT_SECRET'); // config variable — never hardcode
    }

    public static function generateToken($userId, $role) {
        $payload = [
            'iss' => env('APP_URL'),  // iss claim
            'sub' => $userId,         // sub claim
            'role' => $role,
            'iat' => time(),
            'exp' => time() + (24 * 60 * 60)
        ];
        return JWT::encode($payload, self::$secret, self::$algorithm);
    }

    public static function validateToken($token) {
        try {
            return (array) JWT::decode($token, new Key(self::$secret, self::$algorithm));
        } catch (Exception $e) {
            throw new Exception('Invalid token: ' . $e->getMessage());
        }
    }

    public static function refreshToken($token) {
        $decoded = self::validateToken($token);
        if ($decoded['exp'] - time() < 3600) {
            return self::generateToken($decoded['sub'], $decoded['role']);
        }
        return $token;
    }
}

// JwtService.cs
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;

public class JwtService
{
    private readonly string _secret = Environment.GetEnvironmentVariable("JWT_SECRET")!;
    private readonly string _issuer = "your-app";

    public string GenerateToken(string userId, string role)
    {
        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_secret));
        var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

        var claims = new[]
        {
            new Claim(JwtRegisteredClaimNames.Sub, userId),
            new Claim(ClaimTypes.Role, role),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
            new Claim(JwtRegisteredClaimNames.Iat,
                DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString(),
                ClaimValueTypes.Integer64)
        };

        var token = new JwtSecurityToken(
            issuer: _issuer,
            audience: _issuer,
            claims: claims,
            expires: DateTime.UtcNow.AddHours(24),
            signingCredentials: credentials
        );

        return new JwtSecurityTokenHandler().WriteToken(token);
    }

    public ClaimsPrincipal ValidateToken(string token)
    {
        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_secret));
        var tokenHandler = new JwtSecurityTokenHandler();
        var validationParameters = new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = key,
            ValidateIssuer = true,
            ValidIssuer = _issuer,
            ValidateAudience = true,
            ValidAudience = _issuer,
            ClockSkew = TimeSpan.Zero  // Strict expiration — no clock skew buffer
        };
        return tokenHandler.ValidateToken(token, validationParameters, out _);
    }
}