Node.js — Authentication

JWT Authentication

const jwt = require('jsonwebtoken');

// Generate token
const token = jwt.sign({ userId: 1 }, 'secret', { expiresIn: '1h' });

// Verify token
const decoded = jwt.verify(token, 'secret');

Auth Middleware

const auth = (req, res, next) => {
    const token = req.header('Authorization')?.replace('Bearer ', '');
    
    if (!token) {
        return res.status(401).json({ error: 'Access denied' });
    }
    
    try {
        const decoded = jwt.verify(token, process.env.JWT_SECRET);
        req.user = decoded;
        next();
    } catch (err) {
        res.status(400).json({ error: 'Invalid token' });
    }
};

app.get('/protected', auth, (req, res) => {
    res.json({ message: 'Protected content', user: req.user });
});

Password Hashing

const bcrypt = require('bcrypt');

// Hash password
const hashed = await bcrypt.hash(password, 10);

// Compare password
const match = await bcrypt.compare(password, hashed);

Login Endpoint

app.post('/login', async (req, res) => {
    const { email, password } = req.body;
    
    const user = await User.findOne({ email });
    if (!user) return res.status(400).json({ error: 'Invalid credentials' });
    
    const valid = await bcrypt.compare(password, user.password);
    if (!valid) return res.status(400).json({ error: 'Invalid credentials' });
    
    const token = jwt.sign({ id: user.id }, process.env.JWT_SECRET);
    res.json({ token });
});

Mini Practice

1. Implement JWT authentication
2. Create auth middleware
3. Hash and verify passwords
4. Build login/register endpoints

Up Next

Continue with WebSockets — real-time communication.