Node.js Authentication with JWT and Best Practices

Authentication is a critical aspect of web application security. JSON Web Tokens (JWT) have become the de facto standard for stateless authentication in modern web applications. This guide will walk you through implementing secure JWT authentication in Node.js.

Understanding JSON Web Tokens

JWTs are self-contained tokens that carry information about the user and can be verified without storing session state on the server.

const jwt = require('jsonwebtoken');

// Creating a JWT
const token = jwt.sign(
  { 
    userId: user.id, 
    email: user.email,
    role: user.role
  },
  process.env.JWT_SECRET,
  { 
    expiresIn: '24h',
    issuer: 'your-app-name'
  }
);

Secure Token Storage

How you store JWTs on the client-side significantly impacts your application's security posture.

// Setting secure HTTP-only cookie
app.post('/login', async (req, res) => {
  // ... authentication logic
  
  const token = generateToken(user);
  
  res.cookie('token', token, {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'strict',
    maxAge: 24 * 60 * 60 * 1000 // 24 hours
  });
  
  res.json({ user: sanitizeUser(user) });
});

JWT Middleware

Create reusable middleware to protect your routes and extract user information from tokens.

const authenticateToken = (req, res, next) => {
  const token = req.cookies.token || 
               req.headers.authorization?.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ error: 'Access denied' });
  }
  
  try {
    const verified = jwt.verify(token, process.env.JWT_SECRET);
    req.user = verified;
    next();
  } catch (error) {
    res.status(400).json({ error: 'Invalid token' });
  }
};

Security Best Practices

• Use strong, unique JWT secrets
• Implement token refresh mechanisms
• Add rate limiting to authentication endpoints
• Validate and sanitize all inputs
• Use HTTPS in production
• Implement proper logout functionality

Conclusion

Implementing secure JWT authentication requires careful consideration of security best practices. Always prioritize security over convenience and keep your authentication system updated with the latest security standards.