How to Prevent Insecure Code from Cursor

1---
2description: Secure JWT handling patterns
3globs: "*.ts,*.js,*auth*,*token*,*session*"
4alwaysApply: true
5---
6
7# JWT Security Rules
8
9## Token Storage:
10- NEVER store JWTs in localStorage or sessionStorage (XSS vulnerable)
11- ALWAYS use httpOnly, Secure, SameSite=Strict cookies for token storage
12- Access tokens: short-lived (15 min), in memory or httpOnly cookie
13- Refresh tokens: httpOnly cookie only, longer-lived (7 days)
14
15## Signing:
16- NEVER use HS256 with short or hardcoded secrets
17- PREFER RS256 or ES256 with key pairs
18- NEVER hardcode signing keys in source code
19- ALWAYS load keys from environment variables or secret manager
20
21## Validation:
22- ALWAYS verify token signature, expiration, issuer, and audience
23- ALWAYS check token is not on a revocation/blocklist
24- NEVER trust token payload without signature verification
25- Handle expired tokens gracefully with refresh flow
26
27## FORBIDDEN:
28```typescript
29localStorage.setItem('token', jwt);  // NEVER
30const secret = 'my-secret-key';       // NEVER hardcode
31jwt.decode(token);                    // decode without verify = NEVER
32```

1import jwt from 'jsonwebtoken';
2import { Response } from 'express';
3
4const ACCESS_TOKEN_EXPIRY = '15m';
5const REFRESH_TOKEN_EXPIRY = '7d';
6
7export const generateTokens = (userId: string, roles: string[]) => {
8  const accessToken = jwt.sign(
9    { sub: userId, roles, type: 'access' },
10    process.env.JWT_PRIVATE_KEY!,
11    { algorithm: 'RS256', expiresIn: ACCESS_TOKEN_EXPIRY, issuer: process.env.JWT_ISSUER }
12  );
13  const refreshToken = jwt.sign(
14    { sub: userId, type: 'refresh' },
15    process.env.JWT_PRIVATE_KEY!,
16    { algorithm: 'RS256', expiresIn: REFRESH_TOKEN_EXPIRY, issuer: process.env.JWT_ISSUER }
17  );
18  return { accessToken, refreshToken };
19};
20
21export const setTokenCookies = (res: Response, tokens: { accessToken: string; refreshToken: string }) => {
22  res.cookie('access_token', tokens.accessToken, {
23    httpOnly: true, secure: true, sameSite: 'strict', maxAge: 15 * 60 * 1000,
24  });
25  res.cookie('refresh_token', tokens.refreshToken, {
26    httpOnly: true, secure: true, sameSite: 'strict', path: '/api/auth/refresh', maxAge: 7 * 24 * 60 * 60 * 1000,
27  });
28};
29
30export const verifyToken = (token: string): jwt.JwtPayload => {
31  return jwt.verify(token, process.env.JWT_PUBLIC_KEY!, {
32    algorithms: ['RS256'], issuer: process.env.JWT_ISSUER,
33  }) as jwt.JwtPayload;
34};

1@jwt-security.mdc @src/lib/auth-tokens.ts
2
3Create a login endpoint POST /api/auth/login that:
41. Validates email and password from request body with Zod
52. Looks up user by email in the database
63. Verifies password with bcrypt.compare
74. Generates access and refresh tokens using auth-tokens utility
85. Sets tokens as httpOnly, Secure, SameSite cookies (NOT localStorage)
96. Returns only the user profile (no tokens in response body)
107. Handles invalid credentials with a generic error (no user enumeration)
118. Rate limits to 5 attempts per IP per minute

1@jwt-security.mdc @codebase
2
3Audit this project for JWT security vulnerabilities. Check for:
41. Tokens stored in localStorage or sessionStorage
52. HS256 with short or hardcoded secrets
63. jwt.decode() used without jwt.verify()
74. Missing expiration checks on token validation
85. Tokens returned in response bodies (should be cookies only)
96. Missing httpOnly, Secure, or SameSite cookie flags
10
11For each vulnerability, show the file, the insecure code, and the fix.

1@jwt-security.mdc @src/lib/auth-tokens.ts
2
3Create a token refresh endpoint POST /api/auth/refresh that:
41. Reads the refresh token from httpOnly cookie (not request body)
52. Verifies the refresh token signature and expiration
63. Checks the token is not on the revocation blocklist
74. Generates new access AND refresh tokens (rotation)
85. Adds the old refresh token to the blocklist
96. Sets new tokens as httpOnly cookies
107. Handles concurrent refresh requests safely (only one succeeds)
118. Returns 401 if refresh token is invalid or revoked