Secure Web Authentication Using JWT and Role-Based Access Control

Web applications play a critical role in modern digital systems and handle large amounts of sensitive user data, making them a major target for cyber attacks. Weak authentication mechanisms, poor session management, and inadequate access control can lead to vulnerabilities such as Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and session hijacking, resulting in unauthorized access and data breaches. This research presents the design and implementation of a secure role-based authentication framework. The system uses JSON Web Tokens (JWT) for stateless authentication and stores tokens in HTTP-only cookies to prevent client-side access and reduce XSS risks. Role-Based Access Control (RBAC) is implemented to restrict access based on user roles, while secure password hashing and middleware validation enhance overall security. The proposed framework improves authentication security, strengthens session management, and reduces common web vulnerabilities. It is scalable and suitable for integration into modern web applications.