Authentication & Security
JWT + 2FA + session management with 30-day persistent login
Overview
EliteHMS uses a two-token strategy: a 15-minute access token (localStorage) and a 30-day httpOnly cookie refresh token. An Axios interceptor silently refreshes sessions — staff never see a login prompt mid-work. Optional Google Authenticator 2FA with 10 one-time recovery codes. Max 5 active sessions per user with remote logout.
Standard Operating Workflow
Login
Email + password verified. If 2FA enabled: tempToken returned. User enters 6-digit OTP.
Tokens Issued
Access token (15 min) + httpOnly refresh cookie (30 days). User lands on dashboard.
Silent Refresh
Access token expires → Axios interceptor catches 401 → calls /auth/refresh → retries original request. User sees nothing.
2FA Setup
Settings → Security → Enable 2FA. QR code scanned with Google Authenticator. 10 recovery codes generated (bcrypt hashed).
Session Management
View all active sessions with device info. Logout all devices with one click.
Key Operational Benefits
Real-World Healthcare Scenarios
Stolen Phone 2FA Block
Doctor's phone stolen. Attacker has password from breach. Hits 2FA screen. Without the authenticator app, cannot log in. Doctor uses recovery code to log in, changes password.