JWT Authentication Architecture: Access Tokens, Refresh Tokens, and Secure HttpOnly Cookies

A comprehensive, production-ready guide to designing a secure authentication system using short-lived JWT access tokens, database-backed refresh token rotation, and HttpOnly cookies to mitigate XSS and CSRF vulnerabilities.