JWT + Google OAuth Without the Headaches

The shape that works

1. Short-lived access token in an httpOnly, Secure, SameSite=Strict cookie.
2. Google OAuth only mints identity. Your own JWT mints the session.
3. Never trust the client clock. Verify expiry server-side, always.

The checklist I run through

• Cookies are httpOnly (no JS access, ever)
• CSRF state parameter on the OAuth dance
• Rate-limited login route with lockout
• Generic error messages ("invalid credentials", never which half)
• Tokens expire (12h is my default), logout actually clears them

// verify, then decide. Everything else is decoration.
const { payload } = await jwtVerify(token, secret);
if (payload.sub !== "admin") throw new Error("nope");

Auth code should be boring to read and annoying to bypass.