Authentication and JWT Tokens

# CHAPTER 12

Authentication and JWT Tokens #

1. Introduction #

2. Learning Objectives #

• Explain why APIs use Tokens instead of Sessions.

• Hash user passwords using bcrypt.

• Generate a JWT upon successful login.

• Create an Auth Middleware to protect private routes.

3. Beginner-Friendly Explanation #

4. Step 1: Registration and Password Hashing #

Install Dependencies:

npm install bcrypt jsonwebtoken

controllers/authController.js (Register):

const User = require('../models/User'); // Mongoose Model
const bcrypt = require('bcrypt');

const register = async (req, res) => {
    try {
        const { username, password } = req.body;

        // 1. Generate a "salt" (random characters) and hash the password
        const salt = await bcrypt.genSalt(10);
        const hashedPassword = await bcrypt.hash(password, salt);

        // 2. Save the user with the HASHED password, not the real one!
        const newUser = new User({
            username: username,
            password: hashedPassword
        });

        await newUser.save();
        res.status(201).json({ message: "User registered successfully!" });
    } catch (err) {
        res.status(500).json({ error: err.message });
    }
};

5. Step 2: Login and Generating the JWT #

controllers/authController.js (Login):

const jwt = require('jsonwebtoken');

const login = async (req, res) => {
    try {
        const { username, password } = req.body;
        const user = await User.findOne({ username });

        if (!user) return res.status(400).json({ error: "User not found" });

        // 1. Compare the typed password to the database hash
        const validPassword = await bcrypt.compare(password, user.password);
        if (!validPassword) return res.status(400).json({ error: "Invalid password" });

        // 2. SUCCESS! Generate the Wristband (JWT)
        // We embed the user's ID inside the token, and sign it with a secret key
        const token = jwt.sign({ id: user._id }, "MY_SUPER_SECRET_KEY", { expiresIn: "1h" });

        // 3. Send the token to the client
        res.status(200).json({ status: "success", token: token });
    } catch (err) {
        res.status(500).json({ error: err.message });
    }
};

6. Step 3: Protecting Routes (Auth Middleware) #

middleware/auth.js:

const jwt = require('jsonwebtoken');

const verifyToken = (req, res, next) => {
    // 1. Look for the token in the Headers
    const token = req.header('Authorization');
    
    // If no token exists, block them!
    if (!token) return res.status(401).json({ error: "Access Denied. No token provided." });

    try {
        // 2. Verify the token using our secret key
        // Note: The client sends it as "Bearer eyJhbGciOi..." so we split the string to get just the token
        const actualToken = token.split(" ")[1]; 
        
        const verifiedData = jwt.verify(actualToken, "MY_SUPER_SECRET_KEY");
        
        // 3. Attach the decrypted user ID to the request object!
        req.user = verifiedData; 
        
        // 4. Let them onto the dance floor
        next(); 
    } catch (err) {
        res.status(400).json({ error: "Invalid Token" });
    }
};

module.exports = verifyToken;

7. Step 4: Applying the Middleware #

const express = require('express');
const router = express.Router();
const verifyToken = require('../middleware/auth');

// This route is public
router.post('/login', authController.login);

// This route requires the Wristband!
router.get('/profile', verifyToken, (req, res) => {
    // Because the middleware attached req.user, we know exactly who is logged in!
    res.json({ message: "Welcome to your profile", userId: req.user.id });
});

8. Backend Workflow: Testing JWT in Postman #

1. 1. Make a POST request to /login. Copy the long "token" string from the JSON response.

1. 2. Open a new GET request for /profile.

1. 3. Go to the Authorization tab. Select Bearer Token.

1. 4. Paste your token into the box and click Send. You will gain access!

9. Best Practices #

• Hide the Secret Key: In the code above, we hardcoded "MYSUPERSECRETKEY". In the real world, if a hacker finds your secret key, they can mint infinite valid tokens and take over your entire platform. This key MUST be hidden inside a .env file (e.g., process.env.JWTSECRET).

10. Common Mistakes #

• The Bearer Prefix: The industry standard is to send the token as Bearer <token>. Beginners often forget to split the string in the middleware, and they accidentally try to verify the word "Bearer" along with the token, causing a JsonWebTokenError.

11. Exercises #

1. 1. Explain the architectural reason why REST APIs use JSON Web Tokens (stateless) instead of traditional Session Cookies (stateful).

12. Coding Challenges #

• Challenge: Modify the JWT generation code so that the token expires in exactly 15m (15 minutes), and includes the user's role (e.g., 'admin') inside the token payload along with the ID.

13. MCQs with Answers #

14. Interview Questions #

• Q: Walk me through the complete authentication lifecycle of a Node.js API, starting from the moment a user submits their login credentials, to the moment they successfully retrieve their private profile data.

• Q: What is the payload of a JWT? Is it encrypted? (Hint: It is base64 encoded, not encrypted. Anyone can read it, but no one can alter it without the secret key).

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #