Authentication, Authorization, and Security

Implement secure authentication, authorization, password handling, JWT-based APIs, cookies, CSRF protection, input validation, and security best practices.

Authentication vs Authorization

Authentication answers the question 'Who are you?' Authorization answers 'What are you allowed to do?'.

A secure API commonly authenticates a user and then checks whether that identity has permission to perform a particular operation. These concerns should be modeled separately even when implemented within the same middleware pipeline.

Authentication and Authorization

Key Takeaways

Authentication establishes identity.
Authorization determines permissions.
A valid identity does not automatically have access to every resource.

Knowledge Check

Which concept determines whether an authenticated user may perform an operation?

Password Hashing and JWT Authentication

Passwords should never be stored as plaintext. Password hashing algorithms such as Argon2 or bcrypt are designed to make password guessing computationally expensive.

JSON Web Tokens can carry signed claims between systems. A JWT can be useful for stateless API authentication, but token storage, expiration, rotation, revocation, audience validation, and signing-key management must be designed carefully.

Never Trust JWT Claims Blindly

Always verify the signature and validate relevant claims such as issuer, audience, expiration, and intended use.

JWT Verification Concept

import jwt from 'jsonwebtoken';

function authenticate(req, res, next) {
  const token = req.headers.authorization?.replace('Bearer ', '');

  if (!token) {
    return res.status(401).json({ error: 'Missing token' });
  }

  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET);
    next();
  } catch {
    res.status(401).json({ error: 'Invalid token' });
  }
}

💡 The middleware extracts a Bearer token and verifies its signature before allowing the request to continue.

Key Takeaways

Never store plaintext passwords.
JWT verification must validate both the signature and security-relevant claims.
Short-lived access tokens and controlled refresh-token strategies reduce risk.

Knowledge Check

How should user passwords be stored?

Common Web Security Risks

Node.js APIs must defend against common web vulnerabilities including injection, broken access control, cross-site scripting, CSRF, insecure deserialization, credential leakage, and denial-of-service conditions.

Validate input at trust boundaries, use parameterized database operations, enforce authorization server-side, apply rate limits where appropriate, configure secure cookies, and use HTTPS in production.

Key Takeaways

Treat every client input as untrusted.
Authorization must be enforced on the server.
Security headers, rate limiting, input validation, and secure secret handling are essential production practices.

Knowledge Check

Where should authorization checks ultimately be enforced?

Authentication vs Authorization

Password Hashing and JWT Authentication

Common Web Security Risks

STAY UPDATED WITH BYTES!