What does a 401 'token_expired' error mean and how do I fix it?

The JWT's 'exp' claim timestamp is in the past, so the server rejects it. Fix this by implementing a token refresh flow: when you receive a 401 with a token_expired error, send your refresh token to the auth endpoint to get a new access token, then retry the original request. Proactively check expiry before requests to avoid the round-trip.

Why does JWT verification fail with 'invalid signature' even though the token looks correct?

The most common causes are: the signing secret or key was rotated and the token was signed with the old key, the server is using a different algorithm than the token's header specifies, the token was modified after signing (even adding a space breaks the signature), or in microservice architectures different services have different keys. Decode the header to check the 'kid' and 'alg' values.

How do I prevent the JWT 'none' algorithm attack?

Never trust the 'alg' field in the JWT header. Always specify the allowed algorithms explicitly when verifying: jwt.verify(token, key, { algorithms: ['RS256'] }). This prevents attackers from crafting tokens with alg='none' (no signature) or switching from asymmetric (RS256) to symmetric (HS256) algorithms using your public key as the HMAC secret.

Should I store JWTs in localStorage or cookies?

Use httpOnly, Secure, SameSite=Strict cookies for storing JWTs. localStorage is accessible to any JavaScript running on your page, making it vulnerable to XSS attacks. httpOnly cookies cannot be read by JavaScript, and the Secure flag ensures they're only sent over HTTPS. The trade-off is that cookies require CSRF protection, but SameSite=Strict mitigates most CSRF vectors.

What's the difference between a 401 and 403 response for JWT errors?

Return 401 Unauthorized when the token is missing, expired, has an invalid signature, or is malformed — the client's identity cannot be established. Return 403 Forbidden when the token is valid and the user is authenticated, but lacks the required permissions, roles, or claims to access the specific resource. Include a WWW-Authenticate header with 401 responses to indicate the expected auth scheme.

JWT Authentication Errors in APIs