This is based on a previous blog post using Golang, so anyone that is interested how to do this in Go, please check it here
Sometimes, building your own authentication REST API sounds scary but in this post, I'll show you how it's done using Node.js and Express.js. In this post you'll see how to build your own email/password authentication system.
Setting up your Node.js project
Let's initialize the express.js project
mkdir example-auth-api
cd example-auth-api
npm init -y
npm install express bcrypt jsonwebtoken body-parser
Setting up Express.js endpoints
Let's import all the required libraries
const express = require('express');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');
const bodyParser = require('body-parser');
Then let's instantiate our express app.
const app = express();
app.use(bodyParser.json());
Let's add signUp, login as public routes and userProfile protected endpoint.
app.post('/signup', signUp);
app.post('/login',login);
app.get('/users', authMiddleware, userProfile);
Now, let's create the signUp endpoint handler.
const signUp = async (req, res) => {
try {
const { email, password } = req.body;
try {
await getUserByEmail(email);
return res.status(400).json({ error: 'User with this email already exists' });
} catch (err) {
}
const hashedPassword = await bcrypt.hash(password, HASH_COST);
const user = new User(Date.now(), email, hashedPassword);
await CreateUserInDb(user);
res.status(201).json({
message: 'User created successfully',
email: user.email
});
} catch (err) {
res.status(400).json({ error: 'Failed to create user' });
}
}
Now, let's create login endpoint handler.
const login = async (req, res) => {
try {
const { email, password } = req.body;
let user;
try {
user = await getUserByEmail(email);
} catch (err) {
return res.status(401).json({ error: 'Invalid email or password' });
}
const isValid = await bcrypt.compare(password, user.password);
if (!isValid) {
return res.status(401).json({ error: 'Invalid email or password' });
}
const { token, refreshToken } = generateToken(user);
res.status(200).json({
message: 'Login successful',
token,
refreshToken
});
} catch (err) {
res.status(401).json({ error: 'Invalid email or password' });
}
}
This endpoint verifies the user's credentials and generates a token. In production, use a library to create a secure JWT token and hashing passwords.
And finally, the userProfile endpoint handler.
const userProfile = async (req, res) => {
try {
const userId = req.userId;
const user = await GetUserByID(userId);
res.json({ user });
} catch (err) {
res.status(401).json({ error: 'Access Denied!' });
}
}
Protecting Private Routes
In order to protect our private routes we need to use a middleware that keeps non-authenticated HTTP calls to our protected rourtes. As an example, we have 1 protected route that returns the current user's details. Note: it's not recommended to return the full details of the user, this might include sensitive data such as password hash or other unintended leaks.
const authMiddleware = async (req, res, next) => {
const authHeader = req.headers.authorization;
if (!authHeader) {
return res.status(401).json({ error: 'Authorization header missing' });
}
const tokenString = authHeader.replace('Bearer ', '');
try {
const token = jwt.verify(tokenString, JWT_SECRET);
if (!token.sub || token.typ !== 'authentication') {
return res.status(401).json({ error: 'Invalid token claims' });
}
req.userId = token.sub;
next();
} catch (err) {
return res.status(401).json({ error: 'Invalid token' });
}
};
Complete example
Here is the complete example code:
class User {
constructor(id, email, password) {
this.id = id;
this.email = email;
this.password = password;
}
}
const express = require('express');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');
const bodyParser = require('body-parser');
const app = express();
app.use(bodyParser.json());
const JWT_SECRET = 'your-secret-key';
const JWT_AUD_NAME = 'your-audience';
const JWT_ISSUER_NAME = 'your-issuer';
const TOKEN_EXPIRATION_DURATION = '1h';
const REFRESH_TOKEN_EXPIRATION_DURATION = '7d';
const HASH_COST = 10;
async function getUserByEmail(email) {
throw new Error('User not found');
}
async function getUserByID(id) {
throw new Error('User not found');
}
async function CreateUserInDb(user) {
return true;
}
const authMiddleware = async (req, res, next) => {
const authHeader = req.headers.authorization;
if (!authHeader) {
return res.status(401).json({ error: 'Authorization header missing' });
}
const tokenString = authHeader.replace('Bearer ', '');
try {
const token = jwt.verify(tokenString, JWT_SECRET);
if (!token.sub || token.typ !== 'authentication') {
return res.status(401).json({ error: 'Invalid token claims' });
}
req.userId = token.sub;
next();
} catch (err) {
return res.status(401).json({ error: 'Invalid token' });
}
};
function generateToken(user) {
const now = Math.floor(Date.now() / 1000);
const claims = {
sub: user.id,
typ: 'authentication',
aud: JWT_AUD_NAME,
exp: now + (60 * 60),
nbf: now,
iat: now,
iss: JWT_ISSUER_NAME
};
const token = jwt.sign(claims, JWT_SECRET);
claims.typ = 'refresh';
claims.exp = now + (7 * 24 * 60 * 60);
const refreshToken = jwt.sign(claims, JWT_SECRET);
return { token, refreshToken };
}
app.post('/signup', signUp);
app.post('/login',login);
app.get('/profile', authMiddleware, userProfile);
const PORT = process.env.PORT || 8080;
app.listen(PORT, () => {
console.log(`Server running on port ${PORT}`);
});
Conclusion
This simple example shows how to build an email/password authentication REST API. You can expand this by integrating database and implementing getUserByEmail and getUserByID functions. With these building blocks, you're well on your way to create a fully functional authentication system.
Warning: Whatever you do, never try to build your own hashing function. You can also secure your API by using multiple layers of protection, such as OS-level firewall that only allows access to ports you want access from outside.
Please comment below if you're interested in expanding this to also add social authentication providers such as Google or Facebook, etc.