W
Winnoventures
Back to BlogWeb Dev

Designing a SaaS Authentication System: JWTs, Sessions, and Beyond

W
Winnoventures Security TeamApril 15, 202511 min read

The Authentication Landscape in 2025

Authentication has never been more complex — or more critical. Here's our current best-practice approach for SaaS products.

JWT vs Sessions

We use short-lived JWTs (15 minutes) + refresh tokens stored in httpOnly cookies. This gives:

  • Stateless verification (no DB hit on every request)
  • Easy revocation via refresh token blacklisting
  • XSS protection via httpOnly cookies

    • Refresh Token Rotation

    Always rotate refresh tokens on use. If a stolen refresh token is used after rotation, the legitimate session is also invalidated — alerting you to the breach.

    Multi-Factor Authentication

    We implement:

  • 1TOTP (Google Authenticator / Authy) — our default
  • 2SMS OTP — less secure, but needed for some markets
  • 3WebAuthn / FIDO2 — phishing-resistant, increasingly common

    • Passkeys

    Passkeys (WebAuthn) are the future. We've implemented them on 3 client products and seen:

  • 40% faster login vs. password
  • Zero phishing attacks (device-bound keys)
  • 60% reduction in account takeover support tickets

    • Row-Level Security

    For multi-tenant SaaS, implement RLS at the database level (PostgreSQL RLS) as a final safety net — even if your app logic has a bug, tenants can't see each other's data.

    Conclusion

    Invest in auth early. Retrofitting security is 10x more expensive than building it right from the start.

    AuthJWTSecuritySaaS
    W

    Winnoventures Security Team

    Security Engineering · Winnoventures

    Expert insights from the Winnoventures engineering team — sharing what we learn building real products for global clients.