Authentication

Authentication verifies who a user is. In this lesson, you will build a complete authentication system with registration, login, password hashing, JSON Web Tokens (JWT), and protected routes.

Authentication Flow

A typical token-based authentication flow:

User registers with email and password
Server hashes the password and stores the user
User logs in with credentials
Server verifies credentials and returns a JWT
Client sends the JWT with every subsequent request
Server verifies the JWT and grants access

Setting Up

Install the required packages:

npm install bcrypt jsonwebtoken

bcrypt — hashes passwords securely
jsonwebtoken — creates and verifies JWTs

Password Hashing

Never store plain-text passwords. Use bcrypt to hash them:

Ctrl+Enter

HTML

CSS

Preview

Higher salt rounds mean slower hashing (more secure but slower). 12 is a good default.

JSON Web Tokens

A JWT contains a header, payload, and signature. The server signs the token with a secret key, and can later verify it without a database lookup.

Ctrl+Enter

HTML

CSS

Preview

JWT Structure

A JWT looks like xxxxx.yyyyy.zzzzz — three base64-encoded parts separated by dots:

Part	Contains
Header	Algorithm and token type
Payload	User data (claims) and expiration
Signature	Verification hash (header + payload + secret)

User Registration

Ctrl+Enter

HTML

CSS

// src/routes/auth.js
const express = require("express");
const router = express.Router();
const bcrypt = require("bcrypt");
const db = require("../db");
const { generateToken } = require("../utils/jwt");

router.post("/register", async (req, res) => {
const { name, email, password } = req.body;

// Validate input
if (!name || !email || !password) {
  return res.status(400).json({
    error: "Name, email, and password are required",
  });
}

if (password.length < 8) {
  return res.status(400).json({
    error: "Password must be at least 8 characters",
  });
}

// Check if email is taken
const existing = db.prepare("SELECT id FROM users WHERE email = ?").get(email);
if (existing) {
  return res.status(409).json({ error: "Email already registered" });
}

// Hash password and create user
const hashedPassword = await bcrypt.hash(password, 12);

const result = db
  .prepare("INSERT INTO users (name, email, password) VALUES (?, ?, ?)")
  .run(name, email, hashedPassword);

const user = db
  .prepare("SELECT id, name, email FROM users WHERE id = ?")
  .get(result.lastInsertRowid);

const token = generateToken(user);

res.status(201).json({ user, token });
});

Preview

Ctrl+Enter

HTML

CSS

Preview

Notice we return the same error message for both "user not found" and "wrong password." This prevents attackers from discovering which emails are registered.

Auth Middleware

Protect routes by verifying the JWT on every request:

Ctrl+Enter

HTML

CSS

Preview

Protecting Routes

Ctrl+Enter

HTML

CSS

Preview

Security Best Practices

Ctrl+Enter

HTML

CSS

Preview

Security Checklist

Practice	Why
Hash passwords with bcrypt	Protects against database leaks
Use HTTPS in production	Prevents token interception
Set short JWT expiration	Limits damage from stolen tokens
Use httpOnly cookies (optional)	Prevents XSS from accessing tokens
Rate limit login attempts	Prevents brute-force attacks
Return generic error messages	Prevents user enumeration
Validate input length	Prevents DoS via long passwords

Practical Exercise

Wire everything together into a complete auth system:

Ctrl+Enter

HTML

CSS

Preview

Key Takeaways

Never store plain-text passwords — always hash with bcrypt.
JWTs let you verify identity without a database lookup on every request.
Use middleware to protect routes and separate auth logic from business logic.
Return the same error for "user not found" and "wrong password" to prevent user enumeration.
Rate limit login attempts and use HTTPS in production.

Authentication Flow

Setting Up

Password Hashing

JSON Web Tokens

JWT Structure

User Registration

User Login

Auth Middleware

Protecting Routes

Security Best Practices

Rate Limit Login Attempts

Security Checklist

Practical Exercise

Key Takeaways