Authentication Security Tools 2026: Modern Auth Patterns, MFA, Passwordless, and OAuth2

Authentication is the gatekeeper of your application. A single authentication vulnerability can expose your entire user database. Yet authentication is also one of the most complex areas of security — involving cryptography, token management, session handling, breach detection, and user experience trade-offs.

In 2026, the authentication landscape has shifted dramatically toward passwordless solutions, with Passkeys/WebAuthn becoming the dominant standard for consumer applications, while enterprise environments continue to evolve OAuth2 and OIDC implementations. This guide covers the tools and patterns you need to implement authentication security correctly.

Authentication Architecture Overview

Before choosing tools, understand the authentication architecture patterns:

Session-Based Authentication — Server stores session state, browser receives session ID cookie
Token-Based Authentication (JWT) — Stateless tokens stored client-side, validated on each request
OAuth2/OIDC Delegation — Third-party identity providers handle authentication
Passkeys/WebAuthn — Passwordless, cryptographic authentication using device-bound keys
MFA/2FA — Multi-factor authentication layered on top of any primary method

JWT Security

JSON Web Tokens are widely used but frequently implemented incorrectly. This section covers JWT security in depth.

JWT Structure

A JWT has three parts: Header, Payload, Signature. Never store sensitive data in the payload — it is base64-encoded, not encrypted.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Secure JWT Implementation

Node.js with jose library:

import { SignJWT, jwtVerify, createSecretKey } from 'jose';

// Create a secure 256-bit secret from environment variable
const getSecret = () => createSecretKey(
  new TextEncoder().encode(process.env.JWT_SECRET.padEnd(32, '0'))
);

// Issue tokens with proper security settings
async function issueToken(user) {
  const secret = getSecret();
  const now = Math.floor(Date.now() / 1000);

  const accessToken = await new SignJWT({
    sub: user.id,
    email: user.email,
    role: user.role,
    // Don't include sensitive data in JWT payload
  })
    .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
    .setIssuedAt(now)
    .setExpirationTime(now + 900) // 15 minutes - short-lived access tokens
    .setNotBefore(now) // Token not valid before this time
    .setJti(crypto.randomUUID()) // Unique token ID for revocation
    .sign(secret);

  const refreshToken = await new SignJWT({
    sub: user.id,
    jti: crypto.randomUUID(),
  })
    .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
    .setIssuedAt(now)
    .setExpirationTime(now + 60 * 60 * 24 * 7) // 7 days - long-lived refresh token
    .sign(secret);

  return { accessToken, refreshToken };
}

// Verify tokens securely
async function verifyToken(token) {
  const secret = getSecret();
  try {
    const { payload } = await jwtVerify(token, secret, {
      algorithms: ['HS256'], // Only allow specific algorithms
      clockTolerance: 30, // 30 second clock skew tolerance
    });
    return { valid: true, payload };
  } catch (err) {
    // Log the specific error in production for debugging
    console.error('JWT verification failed:', err.message);
    return { valid: false, error: err.message };
  }
}

Python with PyJWT:

import jwt
import datetime
import os
import uuid

SECRET = os.environ.get('JWT_SECRET', '').ljust(32, '0').encode()

def create_access_token(user_id: str, email: str, role: str) -> str:
    now = datetime.datetime.now(datetime.timezone.utc)
    payload = {
        'sub': user_id,
        'email': email,
        'role': role,
        'iat': now,
        'exp': now + datetime.timedelta(minutes=15),
        'nbf': now,
        'jti': str(uuid.uuid4()),
    }
    return jwt.encode(payload, SECRET, algorithm='HS256')

def verify_token(token: str) -> dict | None:
    try:
        payload = jwt.decode(
            token,
            SECRET,
            algorithms=['HS256'],
            options={
                'require': ['sub', 'exp', 'iat', 'nbf', 'jti'],
                'verify_exp': True,
                'verify_nbf': True,
                'verify_iat': True,
            },
            leeway=30,  # 30 second clock skew tolerance
        )
        return payload
    except jwt.ExpiredSignatureError:
        return None
    except jwt.InvalidTokenError as e:
        return None

JWT Blacklisting and Revocation

JWTs are stateless and cannot be individually revoked without a blacklist or short token lifetimes.

// Redis-based token blacklist
import { createClient } from 'redis';

const redis = createClient({ url: process.env.REDIS_URL });
await redis.connect();

async function revokeToken(jti, expiresInSeconds) {
  // Store the revoked token ID with TTL = remaining token lifetime
  await redis.setEx(`revoked:${jti}`, expiresInSeconds, '1');
}

async function isTokenRevoked(jti) {
  const exists = await redis.exists(`revoked:${jti}`);
  return exists === 1;
}

async function verifyTokenWithRevocation(token) {
  const { payload, protectedHeader } = await jwtVerify(token, getSecret());
  const revoked = await isTokenRevoked(payload.jti);
  if (revoked) {
    throw new Error('Token has been revoked');
  }
  return payload;
}

OAuth2 and OpenID Connect

OAuth2 and OIDC are the standards for third-party authentication. Never implement OAuth2 from scratch — use a library or managed service.

OAuth2 Flow Comparison

Flow	Use Case	Security
Authorization Code + PKCE	Mobile/SPA apps	Highest
Authorization Code	Server-side web apps	High
Client Credentials	Machine-to-machine	Medium
Implicit (deprecated)	Legacy SPAs	Low - avoid

Authorization Code + PKCE Implementation

Node.js Express with Passport:

const express = require('express');
const passport = require('passport');
const { Strategy: OAuth2Strategy } = require('passport-oauth2');
const crypto = require('crypto');

const app = express();

// PKCE generator
function generateCodeVerifier() {
  return crypto.randomBytes(32).toString('base64url');
}

async function generateCodeChallenge(verifier) {
  const hash = crypto.createHash('sha256');
  hash.update(verifier);
  return hash.digest('base64url');
}

// OAuth2 routes
app.get('/auth/provider', (req, res) => {
  const verifier = generateCodeVerifier();
  const challenge = await generateCodeChallenge(verifier);

  // Store verifier in secure, HttpOnly cookie
  res.cookie('pkce_verifier', verifier, {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
    maxAge: 600000, // 10 minutes
  });

  const authUrl = new URL('https://auth.provider.com/authorize');
  authUrl.searchParams.set('client_id', process.env.OAUTH_CLIENT_ID);
  authUrl.searchParams.set('redirect_uri', 'https://app.example.com/auth/callback');
  authUrl.searchParams.set('response_type', 'code');
  authUrl.searchParams.set('scope', 'openid profile email');
  authUrl.searchParams.set('code_challenge', challenge);
  authUrl.searchParams.set('code_challenge_method', 'S256');
  authUrl.searchParams.set('state', crypto.randomUUID()); // CSRF protection

  res.redirect(authUrl.toString());
});

app.get('/auth/callback', async (req, res) => {
  const { code, state } = req.query;
  const verifier = req.cookies.pkce_verifier;

  // Exchange code for tokens
  const tokenResponse = await fetch('https://auth.provider.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      client_id: process.env.OAUTH_CLIENT_ID,
      client_secret: process.env.OAUTH_CLIENT_SECRET,
      code,
      redirect_uri: 'https://app.example.com/auth/callback',
      code_verifier: verifier,
    }),
  });

  const tokens = await tokenResponse.json();
  // { access_token, id_token, refresh_token, expires_in }

  // Clear PKCE verifier cookie
  res.clearCookie('pkce_verifier');

  // Verify and decode ID token
  const idToken = await verifyIDToken(tokens.id_token);
  const user = await findOrCreateUser(idToken);

  // Issue session
  req.login(user, (err) => {
    if (err) return res.status(500).json({ error: 'Login failed' });
    res.redirect('/dashboard');
  });
});

Passkeys and WebAuthn

Passkeys are the future of authentication — they are phishing-resistant, never stored on servers, and use cryptographic key pairs managed by the operating system or hardware security module.

WebAuthn Registration Flow

// Using @simplewebauthn/browser for frontend
import {
  startRegistration,
  startAuthentication,
} from '@simplewebauthn/browser';
import { toaster } from '@simplewebauthn/browser';

// Frontend: Start registration
async function registerPasskey() {
  // Fetch options from your server
  const optionsRes = await fetch('/api/auth/webauthn/register-options', {
    credentials: 'include',
  });
  const { options } = await optionsRes.json();

  // Show "Creating passkey..." UI
  const credential = await startRegistration({ optionsArray: [options] });

  // Send credential to server for verification and storage
  const verifyRes = await fetch('/api/auth/webauthn/register-verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ credential }),
    credentials: 'include',
  });

  if (verifyRes.ok) {
    toaster.success('Passkey registered successfully');
  }
}

Server-side WebAuthn with Node.js:

// Node.js server with @simplewebauthn/server
import { generateAuthenticationOptions } from '@simplewebauthn/server';
import { generateRegistrationOptions } from '@simplewebauthn/server';
import { verifyRegistrationResponse } from '@simplewebauthn/server';
import { rpID, origin } from './config';

async function webauthnRegisterOptions(user) {
  const options = await generateRegistrationOptions({
    rpName: 'My App',
    rpID,
    userID: user.id,
    userName: user.email,
    userDisplayName: user.name,
    // Require resident key for passwordless UX
    authenticatorSelection: {
      residentKey: 'required',
      authenticatorAttachment: 'platform',
      userVerification: 'preferred',
    },
    // Use ES256 algorithm
    supportedAlgorithmIDs: [-7, -257], // ES256, RS256
  });

  // Store challenge in session/Redis
  await redis.setEx(`webauthn_challenge:${user.id}`, 300, options.challenge);

  return options;
}

async function webauthnRegisterVerify(userId, credential) {
  const storedChallenge = await redis.get(`webauthn_challenge:${userId}`);
  if (!storedChallenge) {
    throw new Error('No pending challenge');
  }

  const { verified, registrationInfo } = await verifyRegistrationResponse({
    credential,
    expectedChallenge: storedChallenge,
    expectedOrigin: origin,
    expectedRPID: rpID,
    supportedAlgorithmIDs: [-7, -257],
  });

  if (verified) {
    // Store the credential in the database
    await db.saveWebAuthnCredential(userId, {
      credentialID: registrationInfo.credentialID,
      publicKey: registrationInfo.credentialPublicKey,
      counter: registrationInfo.counter,
      deviceType: registrationInfo.deviceType,
    });

    await redis.del(`webauthn_challenge:${userId}`);
  }

  return verified;
}

WebAuthn Authentication Flow

// Frontend authentication
async function authenticateWithPasskey() {
  const optionsRes = await fetch('/api/auth/webauthn/auth-options', {
    credentials: 'include',
  });
  const { options } = await optionsRes.json();

  const credential = await startAuthentication({ optionsArray: [options] });

  const verifyRes = await fetch('/api/auth/webauthn/auth-verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ credential }),
    credentials: 'include',
  });

  if (verifyRes.ok) {
    // Authentication successful
    window.location.href = '/dashboard';
  }
}

Multi-Factor Authentication (MFA)

TOTP Implementation

// Node.js TOTP with otplib
import { authenticator } from 'otplib';
import { toDataURL } from 'qrcode';

// Generate TOTP secret and QR code for setup
async function generateMFASetup(user) {
  const secret = authenticator.generateSecret();
  const email = user.email;
  const issuer = 'MyApp';

  // Store encrypted secret pending verification
  await db.storeMFA.pendingSecret(user.id, encrypt(secret));

  const otpauthUrl = authenticator.keyuri(email, issuer, secret);
  const qrCodeDataURL = await toDataURL(otpauthUrl);

  return { secret, qrCodeDataURL, otpauthUrl };
}

// Verify TOTP code
function verifyTOTP(userSecret, token) {
  // Allow 1 step tolerance (30 seconds before/after)
  return authenticator.verify({ token, secret: userSecret, window: 1 });
}

// Verify with rate limiting
async function verifyTOTPWithRateLimit(userId, token) {
  const key = `mfa_attempt:${userId}`;
  const attempts = await redis.incr(key);

  if (attempts === 1) {
    await redis.expire(key, 300); // 5 minute window
  }

  if (attempts > 5) {
    throw new Error('Too many MFA attempts. Please wait 5 minutes.');
  }

  const secret = await db.getMFA.secret(userId);
  return verifyTOTP(secret, token);
}

Python TOTP with pyotp:

import pyotp
import qrcode
import base64

def generate_mfa_secret():
    return pyotp.random_base32()

def get_mfa_uri(secret: str, email: str) -> str:
    totp = pyotp.TOTP(secret)
    return totp.provisioning_uri(email, issuer_name="MyApp")

def verify_mfa_code(secret: str, code: str) -> bool:
    totp = pyotp.TOTP(secret)
    # Allow 1 step tolerance (30 seconds before/after)
    return totp.verify(code, valid_window=1)

def generate_qr_code(uri: str) -> bytes:
    qr = qrcode.QRCode(version=1, box_size=10, border=5)
    qr.add_data(uri)
    img = qr.make_image(fill_color="black", back_color="white")
    return img.get_image_bytes()

Session Management

Secure Session Implementation

// Node.js with express-session and Redis store
const session = require('express-session');
const RedisStore = require('connect-redis').default;
const { createClient } = require('redis');

const redisClient = createClient({ url: process.env.REDIS_URL });

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  name: '__Host-session', // __Host- prefix requires HTTPS and no subdomain
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'strict', // 'lax' for sites needing some cross-origin
    maxAge: 3600000, // 1 hour
    path: '/',
  },
  // Regenerate session on login to prevent session fixation
  rolling: true,
}));

// Session fixation protection
app.post('/login', async (req, res) => {
  const user = await authenticateUser(req.body.email, req.body.password);

  if (user) {
    // Regenerate session ID before setting user
    req.session.regenerate(async (err) => {
      if (err) {
        return res.status(500).json({ error: 'Login failed' });
      }

      req.session.userId = user.id;
      req.session.role = user.role;
      req.session.mfaVerified = !!user.mfaEnabled;

      await req.session.save();

      res.json({ success: true, requiresMFA: user.mfaEnabled && !req.session.mfaVerified });
    });
  } else {
    res.status(401).json({ error: 'Invalid credentials' });
  }
});

// Session activity tracking
app.use((req, res, next) => {
  if (req.session.userId) {
    req.session.lastActivity = Date.now();
    req.session.save();
  }
  next();
});

Managed Authentication Services

Clerk (Next.js integration)

// middleware.ts - Protect routes with Clerk
import { authMiddleware } from '@clerk/nextjs';

export default authMiddleware({
  publicRoutes: ['/public/:path*', '/api/health'],
  afterAuth(auth, req, evt) {
    if (!auth.userId && !auth.isPublicRoute) {
      return Response.redirect(new URL('/sign-in', req.url));
    }
  },
});

// pages/api/get-user.ts
import { getAuth } from '@clerk/nextjs';
import { clerkClient } from '@clerk/nextjs/server';

export default async function handler(req, res) {
  const { userId } = getAuth(req);

  if (!userId) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  const user = await clerkClient.users.getUser(userId);
  return res.json({
    id: user.id,
    email: user.emailAddresses[0]?.emailAddress,
    name: user.fullName,
    publicMetadata: user.publicMetadata,
  });
}

Auth0 Node.js SDK

// Node.js Express with Auth0
const { auth, requiresAuth } = require('express-openid-connect');

const config = {
  secret: process.env.OIDC_CLIENT_SECRET,
  baseURL: 'https://app.example.com',
  issuerBaseURL: 'https://auth.example.com',
  clientID: process.env.OIDC_CLIENT_ID,
  clientSecret: process.env.OIDC_CLIENT_SECRET,
  authorizationParams: {
    response_type: 'code',
    scope: 'openid profile email',
  },
};

// Protect routes with requiresAuth middleware
app.get('/api/user', requiresAuth(), async (req, res) => {
  // req.oidc.user contains the authenticated user
  res.json({
    sub: req.oidc.user.sub,
    email: req.oidc.user.email,
    name: req.oidc.user.name,
  });
});

// Machine-to-machine token validation
async function validateM2MToken(token) {
  const jwksUri = 'https://auth.example.com/.well-known/jwks.json';
  const audience = 'https://api.example.com';

  try {
    const response = await fetch(jwksUri);
    const jwks = await response.json();

    const decoded = jwt.decode(token, { complete: true });
    const key = jwks.keys.find(k => k.kid === decoded.header.kid);

    return jwt.verify(token, key, { audience, algorithms: ['RS256'] });
  } catch {
    return null;
  }
}

Security Checklist for Authentication

Conclusion

Authentication security in 2026 is a multi-layered challenge. The shift toward passwordless with Passkeys/WebAuthn eliminates entire classes of attacks, but most applications still need to support traditional credentials during transition periods. Using managed services like Clerk or Auth0 handles the complexity of OAuth2, MFA, and session management, letting you focus on your core application while relying on security experts to implement authentication correctly.

For those building custom auth: never store passwords in plain text, use short-lived JWTs with secure storage, implement proper session fixation protection, and always add MFA support. The cost of an authentication breach is far higher than the engineering effort to do it right.