Building Custom Authentication with Express and JWT

Building a secure authentication system is crucial for web applications. Let's create a robust authentication system using Express.js and JSON Web Tokens (JWT) that you can integrate into your projects.

Setting Up the Project

First, let's set up our Express.js project with the necessary dependencies:

const express = require('express')
const jwt = require('jsonwebtoken')
const bcrypt = require('bcryptjs')
const mongoose = require('mongoose')

const app = express()
app.use(express.json())

// Connect to MongoDB
mongoose.connect('mongodb://localhost/auth-demo')

User Model

Create a User model to store user information:

const userSchema = new mongoose.Schema({
  email: {
    type: String,
    required: true,
    unique: true,
    lowercase: true,
    trim: true
  },
  password: {
    type: String,
    required: true,
    minlength: 6
  },
  createdAt: {
    type: Date,
    default: Date.now
  }
})

// Hash password before saving
userSchema.pre('save', async function(next) {
  if (!this.isModified('password')) return next()

  try {
    const salt = await bcrypt.genSalt(10)
    this.password = await bcrypt.hash(this.password, salt)
    next()
  } catch (error) {
    next(error)
  }
})

const User = mongoose.model('User', userSchema)

User Registration

Implement user registration with proper validation:

async function registerUser(req, res) {
  try {
    const { email, password } = req.body

    // Validate input
    if (!email || !password) {
      return res.status(400).json({
        success: false,
        message: 'Email and password are required'
      })
    }

    // Check if user already exists
    const existingUser = await User.findOne({ email })
    if (existingUser) {
      return res.status(400).json({
        success: false,
        message: 'User already exists'
      })
    }

    // Create new user
    const user = new User({ email, password })
    await user.save()

    // Generate JWT token
    const token = jwt.sign(
      { userId: user._id },
      process.env.JWT_SECRET,
      { expiresIn: '24h' }
    )

    res.status(201).json({
      success: true,
      token
    })
  } catch (error) {
    res.status(500).json({
      success: false,
      message: 'Error creating user'
    })
  }
}

app.post('/api/register', registerUser)

User Login

Implement secure user login:

async function loginUser(req, res) {
  try {
    const { email, password } = req.body

    // Find user
    const user = await User.findOne({ email })
    if (!user) {
      return res.status(401).json({
        success: false,
        message: 'Invalid credentials'
      })
    }

    // Verify password
    const isMatch = await bcrypt.compare(password, user.password)
    if (!isMatch) {
      return res.status(401).json({
        success: false,
        message: 'Invalid credentials'
      })
    }

    // Generate token
    const token = jwt.sign(
      { userId: user._id },
      process.env.JWT_SECRET,
      { expiresIn: '24h' }
    )

    res.json({
      success: true,
      token
    })
  } catch (error) {
    res.status(500).json({
      success: false,
      message: 'Error during login'
    })
  }
}

app.post('/api/login', loginUser)

Authentication Middleware

Create middleware to protect routes:

function authenticateToken(req, res, next) {
  const authHeader = req.headers['authorization']
  const token = authHeader && authHeader.split(' ')[1]

  if (!token) {
    return res.status(401).json({
      success: false,
      message: 'Access token required'
    })
  }

  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET)
    req.user = decoded
    next()
  } catch (error) {
    return res.status(403).json({
      success: false,
      message: 'Invalid or expired token'
    })
  }
}

Protected Routes

Implement protected routes using the authentication middleware:

// Protected route example
app.get('/api/profile', authenticateToken, async (req, res) => {
  try {
    const user = await User.findById(req.user.userId)
      .select('-password')

    res.json({
      success: true,
      user
    })
  } catch (error) {
    res.status(500).json({
      success: false,
      message: 'Error fetching profile'
    })
  }
})

Password Reset Flow

Implement a secure password reset mechanism:

// Generate reset token
async function generateResetToken(req, res) {
  try {
    const { email } = req.body
    const user = await User.findOne({ email })

    if (!user) {
      return res.status(404).json({
        success: false,
        message: 'User not found'
      })
    }

    const resetToken = jwt.sign(
      { userId: user._id },
      process.env.JWT_SECRET,
      { expiresIn: '1h' }
    )

    // In production, send this via email
    res.json({
      success: true,
      resetToken
    })
  } catch (error) {
    res.status(500).json({
      success: false,
      message: 'Error generating reset token'
    })
  }
}

// Reset password
async function resetPassword(req, res) {
  try {
    const { token, newPassword } = req.body

    const decoded = jwt.verify(token, process.env.JWT_SECRET)
    const user = await User.findById(decoded.userId)

    if (!user) {
      return res.status(404).json({
        success: false,
        message: 'User not found'
      })
    }

    user.password = newPassword
    await user.save()

    res.json({
      success: true,
      message: 'Password updated successfully'
    })
  } catch (error) {
    res.status(500).json({
      success: false,
      message: 'Error resetting password'
    })
  }
}

Security Best Practices

1. Environment Variables: Store sensitive information in environment variables:

   require('dotenv').config()

   const JWTSECRET = process.env.JWTSECRET const MONGODBURI = process.env.MONGODBURI

2. Rate Limiting: Implement rate limiting to prevent brute force attacks:

   const rateLimit = require('express-rate-limit')

   const limiter = rateLimit({ windowMs: 15 * 60 * 1000, // 15 minutes max: 100 // limit each IP to 100 requests per windowMs })

   app.use('/api/', limiter)

3. Password Validation: Add strong password requirements:

   function validatePassword(password) { const minLength = 8 const hasUpperCase = /[A-Z]/.test(password) const hasLowerCase = /[a-z]/.test(password) const hasNumbers = /\d/.test(password) const hasSpecialChar = /[!@#$%^&*]/.test(password)

   return ( password.length >= minLength && hasUpperCase && hasLowerCase && hasNumbers && hasSpecialChar ) }

4. CORS Configuration: Set up CORS properly:

   const cors = require('cors')

   app.use(cors({ origin: process.env.CLIENT_URL, credentials: true }))

Error Handling

Implement centralized error handling:

// Error handling middleware
app.use((err, req, res, next) => {
  console.error(err.stack)

  res.status(err.status || 500).json({
    success: false,
    message: err.message || 'Internal server error'
  })
})

Testing the Authentication System

Here's a simple test suite using Jest:

const request = require('supertest')
const app = require('./app')

describe('Authentication API', () => {
  it('should register a new user', async () => {
    const res = await request(app)
      .post('/api/register')
      .send({
        email: 'test@example.com',
        password: 'Password123!'
      })

    expect(res.status).toBe(201)
    expect(res.body).toHaveProperty('token')
  })

  it('should login existing user', async () => {
    const res = await request(app)
      .post('/api/login')
      .send({
        email: 'test@example.com',
        password: 'Password123!'
      })

    expect(res.status).toBe(200)
    expect(res.body).toHaveProperty('token')
  })
})

Conclusion

This authentication system provides a solid foundation for securing your Express.js applications. Remember to:

• Store sensitive information in environment variables
• Implement proper error handling
• Use rate limiting for security
• Add password strength requirements
• Set up proper CORS configuration
• Write tests for your authentication endpoints

By following these practices, you'll have a secure and maintainable authentication system for your web applications.