{ "componentChunkName": "component---src-pages-blog-markdown-remark-fields-slug-js", "path": "/blog/user-authentication-in-node", "result": {"data":{"markdownRemark":{"html":"

Table of Contents

\n\n

Introduction

\n

Authentication and authorization are essential for web applications to ensure that only legitimate users gain access and that they can perform actions based on their permissions. Node.js and Express.js are popular tools for building these systems because they allow developers to create fast, scalable apps efficiently.

\n

However, implementing authentication can be challenging—securing passwords, managing sessions, and ensuring tokens aren’t misused require careful planning. Authorization adds more complexity by defining user roles and permissions, ensuring users only access what they’re allowed to. Good user management is critical for protecting both user data and application security, while also maintaining a smooth user experience.

\n

Handling Authorization in Node.js

\n

Difference Between Authentication and Authorization

\n\n

Authentication and authorization complement each other: authentication verifies the user, while authorization governs the extent of their access within the system.

\n
\n

Implementing Role-Based Access Control (RBAC)

\n

RBAC is a widely used strategy to manage user permissions efficiently by assigning roles to users. It simplifies authorization by grouping permissions under specific roles.

\n\n

RBAC simplifies managing access, especially in applications with many users. By grouping permissions under roles, developers can ensure that user privileges are clear and manageable, helping to maintain a secure system.

\n

Node.js User Authentication Prerequisites

\n

To set up a secure user authentication system in Node.js, you’ll need several essential tools and packages. These will enable you to handle routing, password encryption, token management, and cookie parsing, laying the groundwork for a robust authentication flow.

\n

Setting Up the Environment

\n

Install the following packages

\n\n \n \n \n \n
npm init -y\nnpm install express bcrypt jsonwebtoken cookie-parser
\n

Run the server with the following command

\n\n \n \n \n \n
node server.js
\n
\n

Choosing an Authentication Method

\n

There are several popular methods for handling authentication in web applications. Here’s an overview of the most commonly used approaches:

\n
    \n
  • JWT (JSON Web Tokens): JWTs are used for stateless authentication, meaning the server doesn’t store session information. Instead, a token is generated when the user logs in, which includes encoded user data and is sent with each request. The server then verifies the token to authenticate the user, making JWTs ideal for scalable, stateless applications.
    • \n
  • Session-based Authentication: This method involves storing session data on the server to keep track of user activity. When a user logs in, a session is created on the server, and a unique session ID is sent to the user’s browser, often in a cookie. This session ID is then used to identify the user for future requests. Session-based authentication is commonly used in applications where maintaining user state is essential.
    • \n
  • OAuth: OAuth is often used for third-party login, allowing users to sign in with existing accounts from services like Google, Facebook, or GitHub. It simplifies user login by leveraging these providers for authentication, eliminating the need for users to create new credentials for each application. OAuth is widely used in applications that prioritize user convenience and wish to offer social login options.
    • \n
\n

Setting Up the Server and Authentication Routes

\n

To configure the server, connect to MongoDB, and set up authentication routes, write the following code in the Index.js file:

\n

Index.js

\n {\n res.send('This is a protected route');\n });\n\n\n\napp.get('/', (req, res) => {\n res.send('Hello World!');\n});\n\napp.post('/message', async (req, res) => {\n const newMessage = new Message({ text: req.body.text });\n try{\n await newMessage.save();\n res.status(201).json(newMessage);\n } catch (error) {\n res.status(500).json({ error: 'Error saving message' });\n }\n})\n\n\nmongoose\n .connect(process.env.MONGO\\_URI)\n .then(() => console.log('MongoDB Connected'))\n .catch((err) => console.log('MongoDB connection error:', err));\n\napp.listen(PORT, () => {\n console.log(\\`Server is running on port \\${PORT}\\`);\n});`, `87731991274266100000`)\"\n >\n \n \n \n \n
const express = require('express');\nconst mongoose = require('mongoose');\nconst cors = require('cors');\nconst dotenv = require('dotenv');\nconst Message = require('./models/Message');\nconst authRoutes = require('./routes/auth');\nconst auth = require('./middleware/auth');\n\ndotenv.config();\nconst app = express();\nconst PORT = process.env.PORT || 5000;\n\napp.use(cors());\napp.use(express.json());\n\n\n\n// Routes\napp.use('/api/auth', authRoutes);\n\n// Protected route (only accessible with a valid token)\napp.get('/api/private', auth, (req, res) => {\n     res.send('This is a protected route');\n   });\n\n\n\napp.get('/', (req, res) => {\n     res.send('Hello World!');\n});\n\napp.post('/message', async (req, res) => {\n     const newMessage = new Message({ text: req.body.text });\n     try{\n         await newMessage.save();\n         res.status(201).json(newMessage);\n     } catch (error) {\n         res.status(500).json({ error: 'Error saving message' });\n     }\n})\n\n\nmongoose\n     .connect(process.env.MONGO\\_URI)\n     .then(() => console.log('MongoDB Connected'))\n     .catch((err) => console.log('MongoDB connection error:', err));\n\napp.listen(PORT, () => {\n     console.log(`Server is running on port ${PORT}`);\n});
\n

How to Implement User Authentication in Node.js

\n

Backend Implementation

\n

Step 1: User Registration Process

\n

To securely register users, start by creating a Mongoose schema with fields for name, email, and password. Then, hash the password with bcrypt before saving it to enhance security. Finally, include basic validation to ensure required fields and unique email entries. To implement this setup, write the following code:

\n

userModel.js/Models

\n\n \n \n \n \n
const mongoose = require('mongoose');\nconst bcrypt = require('bcryptjs');\n\nconst userSchema = new mongoose.Schema({\n     name: { type: String, required: true },\n     email: { type: String, required: true, unique: true },\n     password: { type: String, required: true },\n   });\n\n// Hash password before saving\nuserSchema.pre('save', async function (next) {\n     if (!this.isModified('password')) return next();\n     this.password = await bcrypt.hash(this.password, 10);\n     next();\n   });\n\nmodule.exports = mongoose.model('User', userSchema);
\n

Step 2: Login and Session Management

\n

To set up a secure login flow, validate user credentials by checking the stored hashed password in the database. JWT tokens will be used to maintain stateless sessions and manage token expiration, adding an extra layer of security. To implement this, write the following code in Auth.js/Routes:

\n

Auth.js/Routes

\n {\n const {name, email, password} = req.body;\n try{\n const newUser = new User({ name, email, password });\n await newUser.save();\n res.status(201).json({message: 'User registered successfully' });\n } catch (error) {\n res.status(400).json({ error: 'User already exists' });\n }\n});\n\n\n//Login user and generate JWT token\nrouter.post('/login', async (req, res) => {\n const { email, password } = req.body;\n try{\n const user = await User.findOne({ email });\n if (!User) return res.status(404).json({ error: 'User not found'});\n\n const isMatch = await bcrypt.compare(password, user.password);\n if (!isMatch) return res.status(401).json({ error: 'Invalid credentials' });\n\n const token = jwt.sign({ userId: user.\\_id }, process.env.JWT\\_SECRET, { expiresIn: '1h'});\n res.json({ token });\n } catch (error) {\n res.status(500).json({ error: 'Server error' });\n }\n});\n\nmodule.exports = router;`, `44603457718107610000`)\"\n >\n \n \n \n \n
const express = require('express');\nconst User = require('../models/User');\nconst jwt = require('jsonwebtoken');\nconst bcrypt = require('bcryptjs');\nconst router = express.Router();\n\n\n// Register a new user\nrouter.post('/register', async (req, res) => {\n     const {name, email, password} = req.body;\n     try{\n         const newUser = new User({ name, email, password });\n         await newUser.save();\n         res.status(201).json({message: 'User registered successfully' });\n     } catch (error) {\n         res.status(400).json({ error: 'User already exists' });\n     }\n});\n\n\n//Login user and generate JWT token\nrouter.post('/login', async (req, res) => {\n     const { email, password } = req.body;\n     try{\n         const user = await User.findOne({ email });\n         if (!User) return res.status(404).json({ error: 'User not found'});\n\n         const isMatch = await bcrypt.compare(password, user.password);\n         if (!isMatch) return res.status(401).json({ error: 'Invalid credentials' });\n\n         const token = jwt.sign({ userId: user.\\_id }, process.env.JWT\\_SECRET, { expiresIn: '1h'});\n         res.json({ token });\n     } catch (error) {\n         res.status(500).json({ error: 'Server error' });\n     }\n});\n\nmodule.exports = router;
\n

Step 3: Protecting Routes with Middleware

\n

To restrict access to certain routes, middleware is used to ensure only authenticated users can access specific pages or data. The following code demonstrates a middleware function that checks for a valid token, verifies it, and grants access if authenticated. Write this code in Auth.js/Middleware:

\n

Auth.js/Middleware

\n {\n const token = req.header('Authorization')?.split(' ')[1];\n if (!token) return res.status(401).json({ error: 'Access denied. No token provided.' });\n\n try {\n const decode = jwt.verify(token, process.env.JWT\\_SECRET);\n req.user = decode;\n next();\n } catch (error) {\n res.status(400).json({ error: 'Invalid Token' });\n }\n};\n\nmodule.exports = auth;`, `84467697158993070000`)\"\n >\n \n \n \n \n
const jwt = require('jsonwebtoken');\n\nconst auth = (req, res, next) => {\n     const token = req.header('Authorization')?.split(' ')[1];\n     if (!token) return res.status(401).json({ error: 'Access denied. No token provided.' });\n\n     try {\n         const decode = jwt.verify(token, process.env.JWT\\_SECRET);\n         req.user = decode;\n         next();\n     } catch (error) {\n         res.status(400).json({ error: 'Invalid Token' });\n     }\n};\n\nmodule.exports = auth;
\n

This middleware function auth verifies if the request contains a valid JSON Web Token (JWT) in the authorization header. It checks for the token, verifies it using the secret key, and either allows access by calling next() or denies access if the token is invalid or missing.

\n

For implementing registration and login with JWT generation, add the following routes in Auth.js/Routes:

\n

Auth.js/Routes

\n {\n const {name, email, password} = req.body;\n try{\n const newUser = new User({ name, email, password });\n await newUser.save();\n res.status(201).json({message: 'User registered successfully' });\n } catch (error) {\n res.status(400).json({ error: 'User already exists' });\n }\n});\n\n\n//Login user and generate JWT token\nrouter.post('/login', async (req, res) => {\n const { email, password } = req.body;\n try{\n const user = await User.findOne({ email });\n if (!User) return res.status(404).json({ error: 'User not found'});\n\n const isMatch = await bcrypt.compare(password, user.password);\n if (!isMatch) return res.status(401).json({ error: 'Invalid credentials' });\n\n const token = jwt.sign({ userId: user.\\_id }, process.env.JWT\\_SECRET, { expiresIn: '1h'});\n res.json({ token });\n } catch (error) {\n res.status(500).json({ error: 'Server error' });\n }\n});\n\nmodule.exports = router;`, `72573543519328190000`)\"\n >\n \n \n \n \n
const express = require('express');\nconst User = require('../models/User');\nconst jwt = require('jsonwebtoken');\nconst bcrypt = require('bcryptjs');\nconst router = express.Router();\n\n\n// Register a new user\nrouter.post('/register', async (req, res) => {\n     const {name, email, password} = req.body;\n     try{\n         const newUser = new User({ name, email, password });\n         await newUser.save();\n         res.status(201).json({message: 'User registered successfully' });\n     } catch (error) {\n         res.status(400).json({ error: 'User already exists' });\n     }\n});\n\n\n//Login user and generate JWT token\nrouter.post('/login', async (req, res) => {\n     const { email, password } = req.body;\n     try{\n         const user = await User.findOne({ email });\n         if (!User) return res.status(404).json({ error: 'User not found'});\n\n         const isMatch = await bcrypt.compare(password, user.password);\n         if (!isMatch) return res.status(401).json({ error: 'Invalid credentials' });\n\n         const token = jwt.sign({ userId: user.\\_id }, process.env.JWT\\_SECRET, { expiresIn: '1h'});\n         res.json({ token });\n     } catch (error) {\n         res.status(500).json({ error: 'Server error' });\n     }\n});\n\nmodule.exports = router;
\n

Frontend Implementation

\n

Finally, to create a simple login form that authenticates users, use the following code:

\n

Login.js

\n {\n e.preventDefault(); // Prevents the page from refreshing on form submission\n\n try {\n const { data } = await axios.post('http://localhost:5000/api/auth/login', {\n email,\n password\n });\n localStorage.setItem('token', data.token); // Store JWT in localStorage\n setMessage('Login Successful');\n onLogin(); // Call onLogin to inform the App component of the login status\n } catch (error) {\n setMessage('Login failed. Check your credentials.');\n }\n };\n\n return (\n
\n

Login

\n
\n setEmail(e.target.value)}\n />\n setPassword(e.target.value)}\n />\n \n \n

{message}

\n
\n );\n}\n\nexport default Login;`, `86993679369528500000`)\"\n >\n \n \n \n \n
import React, { useState } from 'react';\nimport axios from 'axios';\n\nfunction Login({ onLogin }) { // Accept onLogin as a prop\n   const [email, setEmail] = useState('');\n   const [password, setPassword] = useState('');\n   const [message, setMessage] = useState('');\n\n   const handleSubmit = async (e) => {\n     e.preventDefault(); // Prevents the page from refreshing on form submission\n\n     try {\n       const { data } = await axios.post('http://localhost:5000/api/auth/login', {\n         email,\n         password\n       });\n       localStorage.setItem('token', data.token); // Store JWT in localStorage\n       setMessage('Login Successful');\n       onLogin(); // Call onLogin to inform the App component of the login status\n     } catch (error) {\n       setMessage('Login failed. Check your credentials.');\n     }\n   };\n\n   return (\n     <div>\n       <h2>Login</h2>\n       <form onSubmit={handleSubmit}>\n         <input\n           type='email'\n           placeholder='Email'\n           value={email}\n           onChange={(e) => setEmail(e.target.value)}\n         />\n         <input\n           type='password'\n           placeholder='Password'\n           value={password}\n           onChange={(e) => setPassword(e.target.value)}\n         />\n         <button type='submit'>Login</button>\n       </form>\n       <p>{message}</p>\n     </div>\n   );\n}\n\nexport default Login;
\n

Common Pitfalls and Security Best Practices

\n

Building a secure authentication and authorization system requires more than just checking passwords and tokens. Developers must adopt a range of best practices to safeguard user data, prevent unauthorized access, and ensure smooth user experiences. This section highlights common vulnerabilities—like insecure password storage, session mismanagement, and token misuse—and provides practical solutions to address them effectively.

\n

Password Management

\n
    \n
  • Avoid storing plain-text passwords: Store passwords securely using encryption techniques like hashing. Libraries such as bcrypt or argon2 generate hashed passwords that are computationally infeasible to reverse. This way, even if attackers gain access to the database, the original passwords remain protected.
    • \n
  • Regularly update password policies: Encourage the use of strong passwords and implement features like password expiration or complexity requirements to minimize vulnerabilities.
    • \n
\n

Session and Token Management

\n
    \n
  • Short expiration times for tokens: Use short-lived tokens to limit the risk from compromised credentials. For instance, access tokens may expire in 15 minutes, and refresh tokens should be rotated frequently.
    • \n
  • Store sensitive information securely: Keep keys, secrets, and tokens safe by storing them in environment variables. Avoid hardcoding these sensitive values directly into the codebase to prevent exposure during development or deployment.
    • \n
\n

Error Handling and Feedback

\n
    \n
  • Avoid exposing internal information: Carefully design error messages to prevent leaking critical system information. For example, avoid messages like “Invalid username or password” to prevent attackers from inferring valid usernames.
    • \n
  • Provide user-friendly but secure responses: Make sure error messages offer users relevant feedback without revealing sensitive details.
    • \n
\n

Using HTTPS

\n
    \n
  • Encrypt all communication between clients and servers by using HTTPS. Encryption prevents sensitive data, such as login credentials or tokens, from being intercepted during transmission.
    • \n
\n

CSRF Protection

\n
    \n
  • Prevent Cross-Site Request Forgery (CSRF) attacks: Use anti-CSRF tokens for requests that modify data (non-GET requests). Libraries like csurf for Express or built-in protection from tools like Supertokens can simplify the process​.
    • \n
\n

XSS Protection

\n
    \n
  • Mitigate Cross-Site Scripting (XSS) risks: Use HttpOnly cookies to store tokens, ensuring they are inaccessible via JavaScript. This limits exposure to malicious scripts that might run on the client side. Additionally, validate user input and escape content properly to prevent injection attacks​.
    • \n
\n

By following these best practices, developers can create more secure systems, safeguarding both user data and the application from common vulnerabilities.

\n

Simplify Authentication with Supertokens

\n

Introduction to Supertokens

\n

Supertokens is a developer-friendly authentication platform designed to simplify the complexities of managing user sessions and secure access. It provides ready-made solutions for common challenges like user registration, login flows, session handling, and token management, so developers don’t have to build these systems from scratch. With a focus on efficiency and security, Supertokens offers both flexibility and scalability for applications of all sizes.

\n

How Supertokens Helps

\n
    \n
  • Session Management Made Easy: Supertokens automatically handles JWT-based sessions and token rotation, eliminating the need for manual token configurations. This ensures stateless authentication with minimal setup.
    • \n
  • Built-in Social Login: It includes support for social login providers such as Google and Facebook, allowing users to sign up seamlessly without complex custom configurations.
    • \n
  • Multi-Factor Authentication (MFA): For applications that require stronger security, Supertokens provides support for MFA out of the box, offering advanced protection without adding unnecessary development overhead.
    • \n
\n

Advantages Over Manual Implementation

\n
    \n
  • Development Efficiency: By providing secure, pre-built APIs, Supertokens reduces the amount of time needed to set up authentication and session management.
    • \n
  • Reliable and Tested Authentication Flows: Supertokens ensures that authentication processes work consistently by adhering to best practices and implementing features like token rotation and expiration by default.
    • \n
  • Lower Complexity: With Supertokens managing the backend intricacies of authentication, teams can focus on core application features, reducing complexity while maintaining security.
    • \n
\n

Supertokens’ Security Protections: CSRF and XSS Mitigation

\n
    \n
  • CSRF Protection: Supertokens includes built-in CSRF protection for non-GET API routes. This ensures that only legitimate requests are processed, reducing the risk of unauthorized actions through cross-site request forgery attacks​.
    • \n
  • XSS Protection: For enhanced session security, Supertokens uses HttpOnly cookies to store tokens, which prevents them from being accessed by JavaScript in case of an XSS attack​. This makes session management safer by mitigating the risks associated with script injections.
    • \n
\n

Supertokens provides a secure, scalable solution that automates much of the work involved in authentication and session management. By implementing Supertokens, developers can ensure their applications are protected while also saving time and effort that would otherwise go into managing these systems manually.

\n

Conclusion

\n

Authentication and authorization are essential for building secure web applications, requiring developers to carefully balance security, usability, and performance. These components ensure that only verified users gain access to the system and that their actions are appropriately controlled through permissions. This article covered the fundamental steps to build a secure authentication system, focusing on user registration, login, session management, and role-based access control (RBAC) to manage user permissions effectively.

\n

For developers looking to streamline the implementation process, Supertokens offers a powerful, ready-to-use solution. It reduces the time and complexity of managing tokens, sessions, and user roles while incorporating advanced security features such as XSS and CSRF protection. Explore Supertokens to simplify your authentication system, saving development effort and enhancing your application’s security and reliability​.

","frontmatter":{"date":"November 02, 2024","title":"How to Authenticate and Authorize Users in a Node.js Express App","cover":"user-authentication-in-node.png","author":"Mostafa Ibrahim","description":"A step by step guide on how to Authenticate and Authorize Users in a Node.js Express App"},"fields":{"slug":"/user-authentication-in-node/"}},"site":{"siteMetadata":{"title":"SuperTokens Blog"}}},"pageContext":{"id":"0d4d0aea-2efe-51ea-a6fc-1502bfd40c6f","fields__slug":"/user-authentication-in-node/","__params":{"fields__slug":"user-authentication-in-node"}}}, "staticQueryHashes": []}