Authentication and Authorization (JWT, OAuth) in Node.js

Synopsis:

  We will break down what authentication is, what authorization is, and how to implement JWT to secure your API, plus an introduction to OAuth.

• 1. Authentication vs. Authorization:

  It's crucial to understand the difference between these two pillars of security:

  • Authentication: It is the process of verifying a user's identity. It answers the question: Who are you? This is typically achieved through a username and password, fingerprint, facial recognition, etc.

  • Authorization: It is the process of determining what resources or actions an authenticated user is allowed to perform. It answers the question: What can you do? This is based on the user's roles, permissions, or attributes.

• 2. Authentication with JWT (JSON Web Tokens):

  JWT is an open standard (RFC 7519) that defines a compact and secure way to transmit information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

  A JWT consists of three parts separated by dots (.):header.payload.signature

  • Header: Contains the token type (JWT) and the signing algorithm (e.g., HS256, RS256).

  • Payload: Contains "claims" (statements) about the entity (usually the user) and additional data. There are registered claims (e.g., iss for issuer, exp for expiration), public claims, and private claims.

  • Signature: Created by combining the encoded header, the encoded payload, a secret, and the algorithm from the header. This is what allows verifying the token's integrity.

  JWT Authentication Flow:

  1. The client sends credentials (e.g., username and password) to the server.
  2. The server verifies the credentials.
  3. If valid, the server creates a JWT, signs it with a secret, and sends it to the client.
  4. The client stores the JWT (e.g., in localStorage, sessionStorage or cookies).
  5. To access protected resources, the client sends the JWT in the Authorization header (usually as Bearer Token).
  6. The server verifies the JWT's signature. If it's valid and the token hasn't expired, it grants access and can use the payload data for authorization.

  Implementation in Node.js with jsonwebtoken and bcryptjs:

  • Installation:

    npm install jsonwebtoken bcryptjs

  • Password Hashing (bcryptjs):

    Never store passwords in plain text. Use one-way hash functions.

  • JWT Generation and Verification:
• 3. Role-Based Authorization (RBAC):

  Once a user is authenticated, authorization determines what actions they can perform. A common strategy is Role-Based Access Control (RBAC).

  This involves assigning roles (e.g., 'admin', 'editor', 'viewer') to users and then checking if the user has the necessary role to access a resource or execute a function.

• 4. Introduction to OAuth:

  OAuth (Open Authorization) is an open standard for delegated access authorization. It allows users to grant third-party applications limited access to their resources on an HTTP service, without sharing their credentials.

  Common examples: "Sign in with Google", "Sign in with Facebook". Instead of your application asking for the user's password to access their Google account, OAuth allows Google to authorize your application to access certain user data on their behalf.

  • OAuth Roles (simplified):

    • Resource Owner: The end-user who owns the data.

    • Client: The third-party application that wants to access the user's data.

    • Authorization Server: The server that authenticates the user and issues access tokens.

    • Resource Server: The server that hosts the user's data.

  • OAuth Flow (Authorization Code Grant):
    1. The user clicks "Sign in with [Provider]".
    2. Your application redirects the user to the provider's authorization server.
    3. The user signs in to the provider and authorizes your application.
    4. The provider redirects the user back to your application with an "authorization code".
    5. Your application exchanges this code for an "access token" (and optionally a "refresh token") directly with the provider's authorization server.
    6. Your application uses the access token to make requests to the provider's API on behalf of the user.
  • Libraries for OAuth in Node.js:

    The most popular library for OAuth and other authentication strategies is Passport.js. It provides flexible and extensible middleware for Express.js.
    npm install passport passport-google-oauth20 (example for Google)