MERN Authentication & RBAC Best Practices: JWT Refresh Tokens, HttpOnly Cookies, & Role Guards

Implementing authentication in MERN stack applications requires balancing token security against seamless user persistence. Here is the dual-token architecture using short-lived Access Tokens (15 min) and long-lived HttpOnly Refresh Tokens (7 days).

server/middleware/auth.ts

typescript

1400 font-semibold">import { 300 font-medium">Request, 300 font-medium">Response, NextFunction } 400 font-semibold">from 400 font-semibold">class="text-emerald-300">"express";
2400 font-semibold">import jwt 400 font-semibold">from 400 font-semibold">class="text-emerald-300">"jsonwebtoken";
3
4400 font-semibold">export 400 font-semibold">function 300 font-medium">authenticateToken(req: 300 font-medium">Request, res: 300 font-medium">Response, next: NextFunction) {
5  400 font-semibold">const token = req.cookies?.accessToken;
6  400 font-semibold">if (!token) 400 font-semibold">return res.300 font-medium">status(401).300 font-medium">json({ message: 400 font-semibold">class="text-emerald-300">"Authentication required" });
7
8  jwt.300 font-medium">verify(token, process.env.JWT_SECRET!, (err: 300 font-medium">any, user: 300 font-medium">any) => {
9    400 font-semibold">if (err) 400 font-semibold">return res.300 font-medium">status(403).300 font-medium">json({ message: 400 font-semibold">class="text-emerald-300">"Invalid or expired token" });
10    (req 400 font-semibold">as 300 font-medium">any).user = user;
11    300 font-medium">next();
12  });
13}

Engineering a High-Performance Developer Portfolio: TanStack Router, Tailwind CSS v4, & Motion

Lessons from AI Hackathons: Shipping Production-Ready Prototypes in 24 Hours

Integrating Gemini 1.5 Pro into Web Applications: Streaming, Functions, & Schema Validation

A comprehensive guide to building production-grade server-side proxies for the Google GenAI SDK with structured response validation, token usage monitoring, and zero-latency SSE streaming.

Bhuvanesh Jujare

Final-Year CS Student & Full-Stack / AI Developer

+4 more

Read

High-Concurrency Pipelines in React & Node.js: Caching, Rate-Limit Debouncing, & Optimistic UI

System Design

2026-07-15•7 min read•3620

High-Concurrency Pipelines in React & Node.js: Caching, Rate-Limit Debouncing, & Optimistic UI

An architectural deep dive into managing high-frequency client requests, queueing API calls with exponential backoff, and maintaining optimistic UI state with zero race conditions.