Ep5 Golang Microservice JWT Authentication and Refresh Token

We will look at JWT authentication and session management with refresh tokens. We will create endpoints to login/logout/renew/revoke the tokens.

0:00 intro
0:25 what is JWT
2:13 how authentication works & why we need refresh token
3:18 access vs refresh token
4:17 add the users table and storer/server/handler methods to create/list/update/delete user
13:00 add the login endpoint & create JWT with custom claims
24:29 add routes for users endpoints
25:06 add the sessions table and storer/server methods to create/get/revoke/delete session
27:24 modify the login endpoint to return refresh token
29:01 add the logout, renewAccessToken, and revokeSession handlers
31:51 add routes for tokens endpoints
32:10 perform local test with mysql container and postman

[hinocenciopaulo]

This, by far, was the best video that I found on the subject, good paced, nicely explained, clear, and concise. Excellent job! Thank you very much!

[ramdoni]

Yoshaaaa Ready for continue best learn journey🔥🔥🔥🔥

[josepmdc]

your channel is a gold mine, thank you for making these videos!

[Shxvang]

W video. Thank you very much for making these tutorials.

[Rcls]

Lovely video, thank you! I do have one small nitpick of a feedback. You don't need to generate a JWT for refresh tokens. They can be opaque strings and you can persist their expiration in the storage, as you will need to make a trip there anyway to fetch it and revoke it.

[rohangupta]

Epic. I was looking for the same thing all day

[CarlosGomez-ipvj]

Love it! for security aspect, we should send the the refresh token also in the response body and store in a secure place ? I am from web development we use http only cookies so I have these question

[Natewd]

Shouldn't the renew access token endpoint also return a new refresh token?

[ujangaripin]

Thank you bro, I hope there will be a next project, Authentication and Refresh Token with CRUD