Authentication

Verifying who a user is - password hashing, JWT tokens, session-based auth, and protecting routes with middleware.

What it is, in plain English: Authentication answers 'who is this user?' -- as opposed to authorization, which answers 'what are they allowed to do?'. In Express, authentication typically means: hashing passwords before storing them (never plain text), verifying credentials on login, and issuing some form of proof (a session cookie or a JWT token) that the browser sends back on future requests so the server doesn't need to ask for a password every time.

Verifying who someone is

Step 1 -- never store plain text passwords

// npm install bcrypt
import bcrypt from "bcrypt";

// On registration -- hash before storing:
app.post("/register", async (req, res) => {
  const { email, password } = req.body;
  const hashedPassword = await bcrypt.hash(password, 10);   // 10 = salt rounds
  const user = await db.users.create({ email, password: hashedPassword });
  res.status(201).json({ id: user.id, email: user.email });
  // NEVER send the password (even hashed) back in the response
});

// On login -- compare the entered password against the stored hash:
app.post("/login", async (req, res) => {
  const { email, password } = req.body;
  const user = await db.users.findOne({ email });

  if (!user || !(await bcrypt.compare(password, user.password))) {
    return res.status(401).json({ error: "Invalid email or password" });
    // generic message -- don't reveal whether email exists (security)
  }

  // credentials are valid -- issue a token (next section)
});

Step 2 -- issue a JWT token on successful login

// npm install jsonwebtoken
import jwt from "jsonwebtoken";

app.post("/login", async (req, res) => {
  // ... verify password as above ...

  const token = jwt.sign(
    { userId: user.id },              // payload -- data to embed
    process.env.JWT_SECRET,            // secret key -- NEVER hardcode this
    { expiresIn: "1h" }                // token expires in 1 hour
  );

  res.json({ token });
});

// The client stores this token (localStorage or a cookie) and sends it
// with future requests: Authorization: Bearer <token>

Step 3 -- protect routes with middleware

function requireAuth(req, res, next) {
  const authHeader = req.headers.authorization;
  const token = authHeader?.replace("Bearer ", "");

  if (!token) {
    return res.status(401).json({ error: "No token provided" });
  }

  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = decoded;   // attach decoded payload to the request
    next();
  } catch {
    res.status(401).json({ error: "Invalid or expired token" });
  }
}

// Use it on any route that needs a logged-in user:
app.get("/profile", requireAuth, (req, res) => {
  res.json({ userId: req.user.userId });
});

Try It Yourself (Node.js logic)

// Authentication patterns -- password hashing and JWT structure
// (bcrypt and jsonwebtoken need real Node.js -- logic shown runs here)

// Password hashing concept (bcrypt does this properly -- never roll your own):
function simpleHashDemo(password) {
  // This is NOT secure -- just illustrating the one-way concept.
  // Real code: import bcrypt from "bcrypt"; await bcrypt.hash(password, 10)
  let hash = 0;
  for (let i = 0; i < password.length; i++) {
    hash = (hash * 31 + password.charCodeAt(i)) >>> 0;
  }
  return hash.toString(16);
}

const stored = simpleHashDemo("correctPassword123");
console.log("Stored hash:", stored);
console.log("Login attempt 'correctPassword123':", simpleHashDemo("correctPassword123") === stored);
console.log("Login attempt 'wrongPassword':", simpleHashDemo("wrongPassword") === stored);

// JWT structure -- three base64 parts separated by dots
function decodeJWTStructure(token) {
  const [header, payload, signature] = token.split(".");
  return {
    header: JSON.parse(atob(header)),
    payload: JSON.parse(atob(payload)),
    signaturePresent: !!signature,
  };
}

// A real JWT (this is a PUBLIC example token, not a secret):
const exampleJWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjQyLCJyb2xlIjoiYWRtaW4ifQ.signature_would_be_here";
console.log("\nDecoded JWT structure:", decodeJWTStructure(exampleJWT));

// THE FULL AUTH FLOW (reference code -- needs real Express + bcrypt + jsonwebtoken):
const AUTH_FLOW_CODE = `
import bcrypt from "bcrypt";
import jwt from "jsonwebtoken";

// REGISTER
app.post("/register", async (req, res) => {
  const { email, password } = req.body;
  const hashedPassword = await bcrypt.hash(password, 10);
  const user = await db.users.create({ email, password: hashedPassword });
  res.status(201).json({ id: user.id, email: user.email });
});

// LOGIN
app.post("/login", async (req, res) => {
  const { email, password } = req.body;
  const user = await db.users.findOne({ email });
  if (!user || !(await bcrypt.compare(password, user.password))) {
    return res.status(401).json({ error: "Invalid credentials" });
  }
  const token = jwt.sign({ userId: user.id }, process.env.JWT_SECRET, { expiresIn: "1h" });
  res.json({ token });
});

// PROTECT a route with middleware
function requireAuth(req, res, next) {
  const token = req.headers.authorization?.replace("Bearer ", "");
  if (!token) return res.status(401).json({ error: "No token provided" });
  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET);
    next();
  } catch {
    res.status(401).json({ error: "Invalid or expired token" });
  }
}

app.get("/profile", requireAuth, (req, res) => {
  res.json({ userId: req.user.userId });
});
`;
console.log("\nFull JWT auth flow:");
console.log(AUTH_FLOW_CODE.trim());

Session-based auth and the JWT vs session tradeoff

Session-based authentication (the alternative to JWT)

// npm install express-session
import session from "express-session";

app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { httpOnly: true, secure: true, maxAge: 24 * 60 * 60 * 1000 },
}));

app.post("/login", async (req, res) => {
  const user = await authenticateUser(req.body.email, req.body.password);
  if (!user) return res.status(401).json({ error: "Invalid credentials" });

  req.session.userId = user.id;   // server stores this in a session store
  res.json({ loggedIn: true });
});

function requireAuth(req, res, next) {
  if (!req.session.userId) return res.status(401).json({ error: "Not logged in" });
  next();
}

app.post("/logout", (req, res) => {
  req.session.destroy(() => res.json({ loggedOut: true }));
});

JWT vs Sessions -- the real tradeoff

JWT

Sessions

Storage

Client holds the token

Server stores session data

Scaling

Stateless -- easy across servers

Needs shared session store (Redis)

Revocation

Hard (valid until expiry)

Easy (delete from store)

Best for

APIs, mobile apps, microservices

Traditional server-rendered web apps

Refresh tokens -- handling JWT expiry gracefully

// Issue TWO tokens on login: a short-lived access token + long-lived refresh token
app.post("/login", async (req, res) => {
  const user = await authenticateUser(req.body);
  const accessToken  = jwt.sign({ userId: user.id }, process.env.ACCESS_SECRET,  { expiresIn: "15m" });
  const refreshToken = jwt.sign({ userId: user.id }, process.env.REFRESH_SECRET, { expiresIn: "7d" });

  await db.refreshTokens.create({ token: refreshToken, userId: user.id });
  res.json({ accessToken, refreshToken });
});

// When the access token expires, exchange the refresh token for a new one:
app.post("/refresh", async (req, res) => {
  const { refreshToken } = req.body;
  const stored = await db.refreshTokens.findOne({ token: refreshToken });
  if (!stored) return res.status(401).json({ error: "Invalid refresh token" });

  const decoded = jwt.verify(refreshToken, process.env.REFRESH_SECRET);
  const newAccessToken = jwt.sign({ userId: decoded.userId }, process.env.ACCESS_SECRET, { expiresIn: "15m" });
  res.json({ accessToken: newAccessToken });
});

Passport.js, OAuth, and role-based authorization

// Passport.js -- standardises auth across many "strategies" (local, Google, GitHub...)
// npm install passport passport-local passport-google-oauth20

import passport from "passport";
import { Strategy as LocalStrategy } from "passport-local";

passport.use(new LocalStrategy(async (username, password, done) => {
  const user = await db.users.findOne({ email: username });
  if (!user || !(await bcrypt.compare(password, user.password))) {
    return done(null, false, { message: "Invalid credentials" });
  }
  return done(null, user);
}));

app.post("/login", passport.authenticate("local"), (req, res) => {
  res.json({ user: req.user });   // passport attaches the authenticated user
});

// OAuth (e.g. "Sign in with Google") follows the same pattern with a
// different strategy -- the library handles the redirect dance for you:
passport.use(new GoogleStrategy({
  clientID: process.env.GOOGLE_CLIENT_ID,
  clientSecret: process.env.GOOGLE_CLIENT_SECRET,
  callbackURL: "/auth/google/callback",
}, async (accessToken, refreshToken, profile, done) => {
  const user = await findOrCreateUser(profile);
  done(null, user);
}));

Role-based authorization (authentication's companion)

// Authentication: "who are you?" Authorization: "what can you do?"
function requireRole(...allowedRoles) {
  return (req, res, next) => {
    if (!allowedRoles.includes(req.user?.role)) {
      return res.status(403).json({ error: "Insufficient permissions" });
    }
    next();
  };
}

app.delete("/users/:id", requireAuth, requireRole("admin"), (req, res) => {
  // only authenticated admins reach here
});
app.put("/posts/:id", requireAuth, requireRole("admin", "editor"), (req, res) => {
  // admins OR editors can reach here
});

Official Sources

The Codex links only to official documentation. No third-party tutorials.