NodeJS User Authentication

What is user authentication, and why is it important?

User authentication is the process of verifying the identity of a user attempting to access a system. It is an essential part of any application that requires user accounts, as it ensures that only authorized users can access specific resources or perform actions. Authentication prevents unauthorized access and helps protect sensitive information.

How can you implement user authentication in a Node.js application?

User authentication in Node.js can be implemented using various methods, including password-based authentication, OAuth (Open Authorization), and JWT (JSON Web Tokens). The process typically involves verifying a user's credentials (like email and password) against a stored record in a database. A popular package for implementing authentication in Node.js is passport, which supports various authentication strategies like local (username and password), Google OAuth, and more.

How do you hash passwords before storing them in a database?

Before storing passwords in a database, it is essential to hash them to ensure that the original password cannot be easily retrieved in the event of a data breach. The bcrypt library is commonly used to hash passwords in Node.js. Bcrypt adds a salt (random data) to the password and hashes it multiple times, making it more secure.

Example of hashing a password using bcrypt:

const bcrypt = require('bcrypt');

async function hashPassword(plainPassword) {
    const saltRounds = 10;
    const hashedPassword = await bcrypt.hash(plainPassword, saltRounds);
    return hashedPassword;
}

hashPassword('mypassword').then((hashed) => {
    console.log('Hashed password:', hashed);
});

In this example, the password 'mypassword' is hashed using bcrypt and the resulting hash is printed to the console.

How do you verify a password during user login?

When a user attempts to log in, you can compare the password they provide with the hashed password stored in the database. The bcrypt.compare() method is used to check if the provided password matches the stored hash.

Example of verifying a password using bcrypt:

const bcrypt = require('bcrypt');

async function verifyPassword(plainPassword, hashedPassword) {
    const match = await bcrypt.compare(plainPassword, hashedPassword);
    return match;
}

verifyPassword('mypassword', storedHashedPassword).then((isMatch) => {
    if (isMatch) {
        console.log('Password is correct');
    } else {
        console.log('Password is incorrect');
    }
});

In this example, the user's input password is compared with the hashed password stored in the database, and the result is printed.

What is JWT (JSON Web Token), and how is it used in authentication?

JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting information between parties. In authentication, JWT is commonly used for stateless authentication, where the server generates a token after verifying a user's credentials, and the client stores this token (typically in local storage or cookies). For subsequent requests, the client sends the token to the server for verification, allowing the user to access protected routes.

Example of generating a JWT in Node.js using the jsonwebtoken package:

const jwt = require('jsonwebtoken');

function generateToken(user) {
    const token = jwt.sign({ id: user._id, email: user.email }, 'secretKey', {
        expiresIn: '1h',
    });
    return token;
}

const token = generateToken({ _id: '123', email: '[email protected]' });
console.log('JWT token:', token);

In this example, a JWT is generated for a user, and the token is printed to the console.

How do you protect routes in a Node.js application using JWT?

To protect routes in a Node.js application, you can create a middleware function that checks whether the user has provided a valid JWT token. If the token is valid, the user is allowed to access the protected route. If the token is missing or invalid, the user is denied access.

Example of protecting a route using JWT:

const jwt = require('jsonwebtoken');

function authenticateToken(req, res, next) {
    const token = req.headers['authorization'] && req.headers['authorization'].split(' ')[1];
    if (!token) return res.sendStatus(401);  // Unauthorized

    jwt.verify(token, 'secretKey', (err, user) => {
        if (err) return res.sendStatus(403);  // Forbidden
        req.user = user;
        next();
    });
}

// Protected route
app.get('/dashboard', authenticateToken, (req, res) => {
    res.send('Welcome to the dashboard, ' + req.user.email);
});

In this example, the authenticateToken middleware checks for a valid JWT token before allowing access to the /dashboard route.

How do you handle user sessions in Node.js?

User sessions can be managed using the express-session package. Sessions allow you to store user data (like authentication state) on the server, and a session ID is sent to the client as a cookie. The client sends this session ID in subsequent requests, allowing the server to retrieve the session data.

Example of setting up sessions in Node.js:

const session = require('express-session');

app.use(
    session({
        secret: 'yourSecretKey',
        resave: false,
        saveUninitialized: false,
        cookie: { secure: false },  // Use true for HTTPS
    })
);

app.post('/login', (req, res) => {
    req.session.userId = user._id;
    res.send('Logged in');
});

// Accessing session data
app.get('/dashboard', (req, res) => {
    if (!req.session.userId) {
        return res.status(401).send('Unauthorized');
    }
    res.send('Welcome to the dashboard');
});

In this example, the user's session is created upon login, and the session data is used to protect the /dashboard route.

What is OAuth, and how is it used for authentication in Node.js?

OAuth (Open Authorization) is an open standard for access delegation commonly used to grant third-party applications limited access to a user's account without sharing the user's credentials. OAuth is commonly used with services like Google, Facebook, and GitHub to enable social login functionality.

In Node.js, you can implement OAuth authentication using the passport package with strategies like passport-google-oauth20 or passport-github.

Example of using OAuth with Passport and Google:

const passport = require('passport');
const GoogleStrategy = require('passport-google-oauth20').Strategy;

passport.use(
    new GoogleStrategy(
        {
            clientID: 'YOUR_GOOGLE_CLIENT_ID',
            clientSecret: 'YOUR_GOOGLE_CLIENT_SECRET',
            callbackURL: '/auth/google/callback',
        },
        (accessToken, refreshToken, profile, done) => {
            // Find or create user in the database
            User.findOrCreate({ googleId: profile.id }, (err, user) => {
                return done(err, user);
            });
        }
    )
);

// Google login route
app.get('/auth/google', passport.authenticate('google', { scope: ['profile', 'email'] }));

// Google callback route
app.get('/auth/google/callback', passport.authenticate('google', { failureRedirect: '/' }), (req, res) => {
    res.redirect('/dashboard');
});

In this example, the user is authenticated using their Google account, and upon successful login, they are redirected to the dashboard.

What are the best practices for securely storing JWT tokens?

Some best practices for securely storing JWT tokens include:

Use HTTPS: Always transmit JWT tokens over a secure connection (HTTPS) to prevent man-in-the-middle attacks.
Store tokens securely: Store tokens in a secure place, such as HTTP-only cookies, which prevent JavaScript from accessing the token and mitigate XSS attacks.
Set token expiration: Always set an expiration time for JWT tokens using the exp claim to minimize the impact of a stolen token.
Use refresh tokens: Use refresh tokens to generate new access tokens without requiring the user to re-authenticate frequently.

Ads

ParikshaPatr

‹ NodeJS Interview