Advanced token handling

You may have noticed that our simple authentication solution is still missing some features that a fully-fledged solution should have, such as the following:

• Using asymmetric keys for the tokens so that we can verify the authenticity (using the public key) without exposing our secret (the private key) to all services. Up until now, we have been using a symmetric key, which means that we need the same secret to generate and verify a JWT.
• Storing tokens in safe httpOnly cookies so that they can be accessed again, even when the page is refreshed or closed.
• Invalidating tokens after logging out on the backend.

Implementing these things requires a lot of effort manually, so it is best practice to use an authentication solution such as Auth0 or Firebase Auth. These solutions work similarly to our simple JWT implementation, but they provide an external authentication service to create and handle the tokens for us. This chapter intended to introduce...