# JWT Analysis Examples

## Example 1: Security Review

**Input:**
```
Review this JWT implementation: tokens stored in localStorage, HS256 with 128-bit secret, no expiration.
```

**Expected Output:**
Security issues identified: localStorage vulnerable to XSS (use HttpOnly cookies), weak secret (use 256+ bits), missing expiration (always set exp), HS256 acceptable but RS256 preferred.

## Example 2: Algorithm Selection

**Input:**
```
Should I use HS256 or RS256 for JWT signing?
```

**Expected Output:**
HS256: symmetric, simpler, single service. RS256: asymmetric, public verification, microservices. Recommendation based on architecture.

## Example 3: Refresh Token Design

**Input:**
```
Design a secure refresh token mechanism for a web application.
```

**Expected Output:**
Short-lived access tokens (15min), long-lived refresh tokens (7 days), HttpOnly cookies, token rotation, database-backed revocation, implementation pattern.

## Common Use Cases

- Authentication implementation
- Security audit
- Token design
- Migration from sessions
- Microservices auth