Most people fail to launch SaaS because they spend weeks setting up basics like auth and payments.

I removed that part completely.

Now you can start building your idea instantly.

Almost every JWT tutorial I've seen does this:

1. User logs in → gets an access token

2. Token expires → user logs in again

That's a terrible UX. Here's how refresh tokens should actually work:

The correct flow:

1. User logs in → gets a short-lived access token (15 min) + a long-lived refresh token (7 days)

2. Access token is stored in memory (NOT localStorage)

3. Refresh token is stored in an httpOnly cookie (not accessible to JavaScript = safe from XSS)

4. When the access token expires, the client silently hits /auth/refresh with the cookie

5. Server verifies the refresh token, issues a new access token

6. User never notices anything

Why this matters:

• Access tokens in memory = gone on page refresh (short window of exposure)

• Refresh tokens in httpOnly cookies = invisible to XSS attacks

• Short access token TTL = even if stolen, it's useless in 15 minutes

Bonus: Token rotation

Every time a refresh token is used, invalidate the old one and issue a new one. If someone tries to reuse an old refresh token → invalidate ALL tokens for that user (likely compromised).

This is exactly how the auth system in the boilerplate works. No tutorial shortcuts.

Questions? Drop them below 👇

After reviewing hundreds of MERN codebases, these come up constantly:

1. No centralized error handling

Every route has its own try/catch with inconsistent error responses. Fix: one error middleware that catches everything.

2. Business logic in controllers

Your controller shouldn't know how to calculate pricing or validate complex rules. That belongs in a service layer.

3. No input validation

Trusting req.body without validation is asking for bugs (or worse). Use Joi, Zod, or express-validator on every route.

4. Storing secrets in code

Hardcoded API keys, database URLs in git. Use .env files + a config module that validates all required vars at startup.

5. No rate limiting or helmet

Two lines of code that prevent 90% of basic attacks:

app.use(helmet());
app.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));

Which of these have you been guilty of? No shame — I built my first 3 APIs with all 5 of these problems 😅

Most MERN tutorials dump everything into a flat folder. Then 3 months later you're drowning in spaghetti.

Here's the structure I settled on after building 10+ production apps:

server/
├── config/          # env, db, constants
├── controllers/     # route handlers (thin)
├── middleware/       # auth, validation, error
├── models/          # Mongoose schemas
├── routes/          # route definitions
├── services/        # business logic (fat)
├── utils/           # helpers, formatters
└── jobs/            # cron, background tasks

client/
├── components/      # reusable UI
├── pages/           # route-level views
├── hooks/           # custom React hooks
├── context/         # global state
├── services/        # API call functions
├── utils/           # formatters, validators
└── assets/          # images, fonts

The key principle: Controllers stay thin, services stay fat. Controllers handle HTTP concerns (req/res). Services handle business logic. This means your logic is testable and reusable.

What does your folder structure look like? Anything you'd add or change?

I've noticed a pattern — every time I start a new MERN project, after setting up auth and the dashboard, I always reach for the same 3 things:

1. Email notifications system

2. Role-based API middleware

3. File upload with S3

Curious what your go-to "next steps" are after the boilerplate is running. Drop yours below 👇

This kind of feedback directly shapes what gets added to the boilerplate next.

Every time I started a new MERN project, I'd spend the first 2-3 weeks on the same stuff:

• Setting up JWT auth with refresh tokens

• Building the admin dashboard layout

• Writing the same Express middleware for error handling and validation

• Configuring MongoDB schemas with proper indexing

• Organizing folders so the codebase doesn't become a mess at scale

After the 5th time doing this, I stopped and built a reusable foundation. Clean architecture — controllers, services, repositories. Not "tutorial-level" code. The kind of structure that actually scales when you have 50+ routes and multiple developers.

The auth system alone handles registration, login, password reset, email verification, and role-based access control with admin/user/moderator roles. The admin dashboard comes with user management, analytics views, and settings panels — all wired up.

I've been using this exact boilerplate for every freelance project and side project for the past year. Figured other developers could use it too.

If you're a junior or mid-level developer trying to understand how production Node.js + React apps are actually structured — this is the shortcut I wish I had.

Thanks for grabbing the MERN Boilerplate. Here's how to hit the ground running:

1. Download the boilerplate from the Files section.

2. Install dependencies:

cd client && npm install
cd ../server && npm install

3. Set up your environment variables — check the .env.example files in both /client and /server.

4. Run the dev server:

npm run dev

What's included:

• JWT authentication (login, register, password reset)

• Role-based access control (admin, user, moderator)

• Admin dashboard with user management, analytics, and settings

• Clean folder structure following controller-service-repository pattern

• Pre-configured MongoDB connection with Mongoose models

• API validation with Joi

• Error handling middleware

• Responsive frontend with React + Tailwind

Need help? Drop your question in the Community Chat — I'm active there.

Ship fast. 🚀