JuanMa JWT Auth Pro

Unlike basic JWT plugins that use single long-lived tokens, JWT Auth Pro implements modern OAuth 2.0 security best practices with short-lived access tokens and secure refresh tokens.

Why JWT Auth Pro?

The Problem with Basic JWT Plugins: * Long-lived tokens (24h+) = Higher security risk * No refresh mechanism = Tokens live until expiry * XSS vulnerable = Tokens stored in localStorage * No revocation = Can’t invalidate compromised tokens

JWT Auth Pro Solution: * Short-lived access tokens (1h default) = Minimal attack window * Secure refresh tokens = HTTP-only cookies, XSS protected * Automatic token rotation = Fresh tokens on each refresh * Complete session control = Revoke any user session instantly

Features

• Simple JWT Authentication — Clean, stateless token-based auth
• HTTPOnly Refresh Tokens — Secure refresh tokens in HTTP-only cookies
• Token Rotation — Automatic refresh token rotation for enhanced security
• CORS Support — Proper cross-origin request handling
• Clean Admin Interface — Simple configuration in WordPress admin
• Developer Friendly — Clear endpoints and documentation

Security Comparison

Feature Basic JWT Plugins JWT Auth Pro

Token Lifetime Long (hours/days) Short (1 hour)

Refresh Tokens None Secure HTTP-only

XSS Protection Limited HTTP-only cookies

Token Revocation Manual only Automatic rotation

Session Management None Database tracking

Security Metadata None IP + User Agent

Perfect for:

• Single Page Applications (React, Vue, Angular)
• Mobile Applications (iOS, Android)
• API Integrations (Third-party services)
• Headless WordPress (Decoupled architecture)

API Endpoints

• POST /wp-json/jwt/v1/token — Login and get access token
• POST /wp-json/jwt/v1/refresh — Refresh access token
• GET /wp-json/jwt/v1/verify — Verify token and get user info
• POST /wp-json/jwt/v1/logout — Logout and revoke refresh token

Security

• Stateless Authentication — JWT tokens contain all necessary information
• HTTPOnly Cookies — Refresh tokens stored securely, inaccessible to JavaScript
• Token Rotation — Refresh tokens automatically rotate on use
• Configurable Expiration — Set custom expiration times
• IP & User Agent Tracking — Additional security metadata

Support

For support and documentation, visit: https://github.com/juanma-wp/jwt-auth-pro-wp-rest-api

Privacy Policy

This plugin stores user session data including IP addresses and user agent strings for security purposes. This data is used solely for authentication and security monitoring.