Implement JWT Authentication

Prerequisites: completed Session-Based Auth Fundamentals, comfort with async/await.

Version note: verified against current documentation as of July 2026. This project uses jose rather than jsonwebtoken. jose is built on the Web Crypto API, runs identically across Node.js, Deno, Bun, browsers, and edge runtimes (jsonwebtoken is Node.js-only), and is the library referenced by default in Auth.js and most current framework auth guides. jose requires the signing algorithm to be declared explicitly on every sign and verify call by design — there is no algorithm-inference fallback — which closes the historical 'alg: none' and algorithm-confusion vulnerability classes at the API level rather than relying on the caller remembering an options flag.

A JWT is a signed claim, not a lookup key — once issued, any server holding the verification key can validate it without a database round-trip or a shared session store, which is exactly what makes JWTs attractive for APIs consumed by multiple independent services. The cost is the mirror image of session auth's strength: you can't instantly kill a JWT the way you can delete a session row. This project builds the standard mitigation for that — short-lived access tokens plus longer-lived, database-tracked (and therefore revocable) refresh tokens — signed with an asymmetric key pair so any service can verify tokens without ever holding the signing key.