4 Security Bugs I Found in My Own Auth System (And How I Fixed Them)

So recently I took on a challenge to learn advanced backend engineering all by myself. Quite a huge task, but I had to lock in.

Naturally, the time came when I was building a secure Authentication System with JWT Tokens — using Refresh and Access Tokens for session management.

Later, when I was studying common security attacks, I realized my own code would be pretty vulnerable in production. Here are the 4 bugs I found and exactly how I fixed them.

Bug 1 — SQL Injection

I was building query strings by directly embedding user input: