{"id":920,"date":"2022-01-23T00:15:40","date_gmt":"2022-01-22T23:15:40","guid":{"rendered":"https:\/\/nguenkam.com\/blog\/?p=920"},"modified":"2022-01-23T00:15:40","modified_gmt":"2022-01-22T23:15:40","slug":"nodejs-jwt-authentication","status":"publish","type":"post","link":"https:\/\/nguenkam.com\/blog\/index.php\/2022\/01\/23\/nodejs-jwt-authentication\/","title":{"rendered":"NodeJS – JWT Authentication"},"content":{"rendered":"\n

JSON Web Tokens<\/a>\u00a0(JWTs) supports authorization and information exchange.<\/p>\n\n\n\n

One common use case is for allowing clients to preserve their session information after logging in. By storing the session information locally and passing it to the server for authentication when making requests, the server can trust that the client is a registered user.<\/p>\n\n\n\n

In this article, we will learn about the applications of JWTs in a server-client relationship using Node.js and vanilla JavaScript.<\/p>\n\n\n\n

Step 1 \u2014 Generating a Token<\/span><\/h4>\n\n\n\n

jsonwebtoken<\/code> is an implementation of JSON Web Tokens.<\/p>\n\n\n\n

You can add it to your JavaScript project by running the following command in your terminal:<\/p>\n\n\n\n

npm install jsonwebtoken<\/code><\/pre>\n\n\n\n
And import it into your files like so:<\/p>\n\n\n\n
const jwt = require('jsonwebtoken');<\/code><\/pre>\n\n\n\n
To sign a token, you will need to have 3 pieces of information:<\/p>\n\n\n\n
  1. The token secret<\/li>
  2. The piece of data to hash in the token<\/li>
  3. The token expire time<\/li><\/ol>\n\n\n\n
    The\u00a0token secret<\/strong><\/em>\u00a0is a long random string used to encrypt and decrypt the data.<\/p>\n\n\n\n
    To generate this secret and make it more complicated to be hacked, one option is to use Node.js\u2019s built-in\u00a0crypto<\/code>\u00a0library, like so:<\/p>\n\n\n\n
    > require('crypto').randomBytes(64).toString('hex')\r\n\/\/'09f26e402586e2faa8da4c98a35f1b20d6b033c6097befa8be3486a829587fe2f90a832bd3ff9d42710'<\/code><\/pre>\n\n\n\n
    PS:<\/strong><\/span><\/em> Be careful! If your\u00a0secret<\/code>\u00a0is simple, the token verification process will be much easier to break by an unauthorized intruder.<\/em><\/p>\n\n\n\n
    Now, store this secret in your project\u2019s\u00a0.env<\/code>\u00a0<\/strong>file<\/em>:<\/p>\n\n\n\n
    TOKEN_SECRET=09f26e402586e2faa8da4c98a35f1b20d6b033c60...<\/code><\/pre>\n\n\n\n
    To bring this token into a Node.js file and to use it, you have to use\u00a0dotenv<\/code>:<\/p>\n\n\n\n
    npm install dotenv\r<\/code><\/pre>\n\n\n\n
    And import it into your files like so:<\/p>\n\n\n\n
    const dotenv = require('dotenv');\r\n\r\n\/\/ get config vars\r\ndotenv.config();\r\n\r\n\/\/ access config var\r\nprocess.env.TOKEN_SECRET;<\/code><\/pre>\n\n\n\n
    The piece of data<\/em> that you hash in your token can be something either a user ID or username or a much more complex object. In either case, it should be an identifier<\/em> for a specific<\/em> user.<\/p>\n\n\n\n
    The token expire time<\/em> is a string, such as 1800 seconds (30 minutes), that details how long until the token will be invalid.<\/p>\n\n\n\n
    Here\u2019s an example of a function for signing tokens:<\/p>\n\n\n\n
    function generateAccessToken(username) {\r\n  return jwt.sign( { username: username }, \n                   process.env.TOKEN_SECRET, \n                   { expiresIn: '1800s' }\n                );\r\n}<\/code><\/pre>\n\n\n\n
    This can be sent back from a request to sign in or log in a user:<\/p>\n\n\n\n
    app.post('\/api\/createNewUser', (req, res) => {\r\n  \/\/ ...\r\n\r\n  const token = generateAccessToken({ username: req.body.username });\r\n  res.json(token);\r\n\r\n  \/\/ ...\r\n});<\/code><\/pre>\n\n\n\n
    This example takes the\u00a0username<\/code>\u00a0value from the\u00a0req<\/code>\u00a0(request<\/em>). And provides the token as the\u00a0res<\/code>\u00a0(response<\/em>).<\/p>\n\n\n\n
    That concludes how\u00a0jsonwebtoken<\/code>,\u00a0crypto<\/code>, and\u00a0dotenv<\/code>\u00a0can be used to generate a JWT.<\/p>\n\n\n\n
    <\/div>\n\n\n\n
    Step 2 \u2014 Authenticating a Token<\/span><\/h4>\n\n\n\n
    There are many ways to go about implementing a JWT authentication system in an Express.js<\/a> application.<\/p>\n\n\n\n
    One approach is to use the\u00a0middleware<\/a>\u00a0functionality in Express.js.<\/p>\n\n\n\n
    How it works is when a request is made to a specific route, you can have the (req, res)<\/code> variables sent to an intermediary function before the one specified in the app.get((req, res) => {})<\/code>.<\/p>\n\n\n\n
    The middleware is a function that takes parameters of (req, res, next)<\/code>.<\/p>\n\n\n\n