Authentication in Node.js Applications

1. Introduction

Authentication is a critical aspect of web applications, ensuring that users are who they claim to be. In Node.js applications, authentication can be implemented using various methods and libraries. This lesson provides a comprehensive overview of authentication concepts, methods, and best practices in Node.js.

2. Key Concepts

3. Authentication Methods

1. Session-Based Authentication: User credentials are stored in a session on the server.
2. Token-Based Authentication: A token is generated after user login and sent with each request.
3. OAuth 2.0: A protocol that allows third-party applications to access user data without sharing credentials.

4. Implementation

Using JSON Web Tokens (JWT)

JWT is a popular method for token-based authentication in Node.js applications. Here's a step-by-step implementation:

Step 1: Install Dependencies

npm install express jsonwebtoken bcryptjs

Step 2: Create a Simple Server

const express = require('express');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcryptjs');
const app = express();
app.use(express.json());

const users = []; // In-memory user storage
        

Step 3: User Registration

app.post('/register', async (req, res) => {
    const hashedPassword = await bcrypt.hash(req.body.password, 10);
    users.push({ username: req.body.username, password: hashedPassword });
    res.status(201).send('User registered');
});
        

Step 4: User Login

app.post('/login', async (req, res) => {
    const user = users.find(u => u.username === req.body.username);
    if (user && await bcrypt.compare(req.body.password, user.password)) {
        const token = jwt.sign({ username: user.username }, 'secretKey', { expiresIn: '1h' });
        res.json({ token });
    } else {
        res.status(400).send('Invalid credentials');
    }
});
        

Step 5: Protected Route

app.get('/protected', authenticateToken, (req, res) => {
    res.send('This is a protected route');
});

function authenticateToken(req, res, next) {
    const token = req.headers['authorization'] && req.headers['authorization'].split(' ')[1];
    if (!token) return res.sendStatus(401);
    jwt.verify(token, 'secretKey', (err, user) => {
        if (err) return res.sendStatus(403);
        req.user = user;
        next();
    });
}

app.listen(3000, () => {
    console.log('Server running on port 3000');
});
        

5. Best Practices

• Use HTTPS to secure data in transit.
• Store passwords securely using hashing algorithms (e.g., bcrypt).
• Implement rate limiting to protect against brute force attacks.
• Use environment variables to manage sensitive information.

6. FAQ