Authentication and Authorization in APIs

# CHAPTER 10

Authentication and Authorization in APIs #

1. Introduction #

2. Learning Objectives #

• Clearly define the difference between Authentication (AuthN) and Authorization (AuthZ).

• Understand how stateless APIs verify identity without utilizing server RAM sessions.

• Explain the role of JSON Web Tokens (JWT) in API security.

• Transmit tokens via the Authorization: Bearer HTTP header.

• Implement middleware to protect API routes and enforce user roles.

3. Beginner-Friendly Explanation #

• Authentication (AuthN): You walk up to the front door. The security guard asks for your driver's license. They verify the face matches the ID. You have proven *who* you are. The guard prints you a temporary ID Badge.

• Authorization (AuthZ): You walk to the server room door. You swipe your ID Badge. The system checks the badge to see if you are a "Janitor" or an "IT Admin". If you are a Janitor, the light flashes red, and the door stays locked. It verifies *what* you are allowed to do.

In REST APIs, Authentication generates the JWT (The ID Badge), and Authorization checks the roles embedded inside that JWT.

4. The Stateless Problem #

5. JSON Web Tokens (JWT) #

// The JWT Payload
{
  "userId": 42,
  "role": "admin",
  "exp": 1700000000 
}

6. Transmitting the Token (The Request) #

GET /api/dashboard HTTP/1.1
Host: api.mywebsite.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsIn...

*(The term "Bearer" literally means "Give access to the bearer of this token".)*

7. Implementing Protection Middleware #

Node.js/Express Example:

const jwt = require('jsonwebtoken');

// The Middleware Guard
function authenticateToken(req, res, next) {
    const authHeader = req.headers['authorization'];
    const token = authHeader && authHeader.split(' ')[1]; // Extract the token string

    if (!token) return res.status(401).json({ error: "Access Denied. No token provided." });

    // Mathematically verify the signature
    jwt.verify(token, process.env.SECRET_KEY, (err, decodedUser) => {
        if (err) return res.status(403).json({ error: "Invalid or expired token." });
        
        // Success! Attach the user payload to the request object
        req.user = decodedUser; 
        next(); // Proceed to the final route logic
    });
}

// Protecting the Route
app.get('/api/dashboard', authenticateToken, (req, res) => {
    res.json({ message: `Welcome User ID: ${req.user.userId}` });
});

8. Implementing Authorization (RBAC) #

// Another Middleware Guard for Roles
function requireAdmin(req, res, next) {
    // We rely on req.user which was populated by authenticateToken
    if (req.user.role !== 'admin') {
        return res.status(403).json({ error: "Forbidden: Admin privileges required." });
    }
    next();
}

// Chaining Middlewares: Must be logged in AND must be an admin
app.delete('/api/users/:id', authenticateToken, requireAdmin, (req, res) => {
    // Delete logic...
    res.status(204).send();
});

9. Machine-to-Machine Authentication (API Keys) #

10. Best Practices #

• Short-Lived Access Tokens: Because stateless JWTs cannot easily be revoked (destroyed) from a central database if stolen, they must have very short lifespans (e.g., 15 minutes). You pair them with a long-lived, securely stored "Refresh Token" to keep the user logged in seamlessly without compromising security.

11. Common Mistakes #

• Putting Passwords in JWTs: Beginners often put the user's password hash or sensitive PII (Personally Identifiable Information) inside the JWT payload. JWT payloads are NOT encrypted; they are only Base64 encoded. Anyone who intercepts the token can decode and read the JSON payload. Only include meaningless identifiers like userId and role.

12. Exercises #

1. 1. Explain the chronological difference between Authentication (AuthN) and Authorization (AuthZ) in an API request pipeline.

13. Coding Challenges #

• Challenge: Look at the authenticateToken middleware. What specific HTTP Status Code is returned when the user fails to provide a token? What code is returned when the token is provided, but the mathematical signature verification fails?

14. MCQs with Answers #

15. Interview Questions #

• Q: Walk me through the implementation of JWT Authentication in a decoupled REST API. How is the token generated, where is it stored by the client, how is it transmitted, and how does the server verify it without looking up a database session?

• Q: Explain Role-Based Access Control (RBAC). How do you architect Express.js middleware to enforce specific roles on specific endpoint routes?

16. FAQs #

17. Summary #

18. Next Chapter Recommendation #