{"componentChunkName":"component---src-pages-markdown-remark-fields-slug-js","path":"/engineering/nodejs-and-mongodb-application-authentication-by-jwt/","result":{"data":{"markdownRemark":{"id":"30bc4404-9225-5434-9fe8-34366bb6a88b","excerpt":"In this blog, we’ll be implementing authentication with JWT in a NodeJS web application. For this, we’ll be using jsonwebtoken package What is JWT? JWT(JSON…","html":"

In this blog, we’ll be implementing authentication with JWT in a NodeJS web application. For this, we’ll be using jsonwebtoken package

\n

What is JWT?

\n

JWT(JSON Web Token) is a token format. It is digitally-signed, self-contained, and compact. It provides a convenient mechanism for transferring data. JWT is not inherently secure, but the use of JWT can ensure the authenticity of the message so long as the signature is verified and the integrity of the payload can be guaranteed. JWT is often used for stateless authentication in simple use cases involving non-complex systems.

\n

Here's an example of JWT:

\n
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6Im9sYXR1bmRlZ2FydWJhQGdtYWlsLmNvbSIsIm
\n

Now, let's authenticate/protect some routes.

\n

Pre-requisites:

\n\n

you can install all required packages by using following command:

\n
npm install express mongoose bcrypt  --save
\n

Step 1. First, create a directory structure as below :

\n

JWTApp

\n
-api\n--models\n----userModel.js\n--controllers\n----userController.js\n--route\n----userRoute.js\n--server.js
\n

Step 2. Install “jsonwebtoken” packageby using following command

\n
 npm install jsonwebtoken -- save
\n

Step 3. Create the user model

\n

In the api/models folder, create a file called user userModel.js by running touch api/models/userModel.js.

\n

In this file, create a mongoose schema with the following properties:

\n\n

Add the following code

\n
'use strict';\n\nvar mongoose = require('mongoose'),\n  bcrypt = require('bcrypt'),\n  Schema = mongoose.Schema;\n\n/**\n * User Schema\n */\nvar UserSchema = new Schema({\n  fullName: {\n    type: String,\n    trim: true,\n    required: true\n  },\n  email: {\n    type: String,\n    unique: true,\n    lowercase: true,\n    trim: true,\n    required: true\n  },\n  hash_password: {\n    type: String\n  },\n  created: {\n    type: Date,\n    default: Date.now\n  }\n});\n\nUserSchema.methods.comparePassword = function(password) {\n  return bcrypt.compareSync(password, this.hash_password);\n};\n\nmongoose.model('User', UserSchema);
\n

Step 4. Create the user handlers

\n

In the api/controllers folder, create a file called user userController.js by running touch api/controllers/userController.js

\n

In the userController file, create three different handlers to handle by using the following code

\n
'use strict';\n\nvar mongoose = require('mongoose'),\n  jwt = require('jsonwebtoken'),\n  bcrypt = require('bcrypt'),\n  User = mongoose.model('User');\n\nexports.register = function(req, res) {\n  var newUser = new User(req.body);\n  newUser.hash_password = bcrypt.hashSync(req.body.password, 10);\n  newUser.save(function(err, user) {\n    if (err) {\n      return res.status(400).send({\n        message: err\n      });\n    } else {\n      user.hash_password = undefined;\n      return res.json(user);\n    }\n  });\n};\n\nexports.sign_in = function(req, res) {\n  User.findOne({\n    email: req.body.email\n  }, function(err, user) {\n    if (err) throw err;\n    if (!user || !user.comparePassword(req.body.password)) {\n      return res.status(401).json({ message: 'Authentication failed. Invalid user or password.' });\n    }\n    return res.json({ token: jwt.sign({ email: user.email, fullName: user.fullName, _id: user._id }, 'RESTFULAPIs') });\n  });\n};\n\nexports.loginRequired = function(req, res, next) {\n  if (req.user) {\n    next();\n  } else {\n\n    return res.status(401).json({ message: 'Unauthorized user!!' });\n  }\n};\nexports.profile = function(req, res, next) {\n  if (req.user) {\n    res.send(req.user);\n    next();\n  } \n  else {\n   return res.status(401).json({ message: 'Invalid token' });\n  }\n};
\n

Note: A hash password was saved in the database using bcrypt.

\n

Step 6. In the api/route folder, create a file called user userRoute.js and add the following code:

\n
'use strict';\nmodule.exports = function(app) {\n    var userHandlers = require('../controllers/userController.js');\n    // todoList Routes\n    app.route('/tasks')\n        .post(userHandlers.loginRequired, userHandlers.profile);\n    app.route('/auth/register')\n        .post(userHandlers.register);\n   app.route('/auth/sign_in')\n        .post(userHandlers.sign_in);\n};
\n

Step 7. Add the following code in server.js

\n
'use strict';\n\nvar express = require('express'),\n  app = express(),\n  port = process.env.PORT || 3000,\n\n\n  User = require('./api/models/userModel'),\n  bodyParser = require('body-parser'),\n  jsonwebtoken = require("jsonwebtoken");\n\nconst mongoose = require('mongoose');\nconst option = {\n    socketTimeoutMS: 30000,\n    keepAlive: true,\n    reconnectTries: 30000\n};\n\nconst mongoURI = process.env.MONGODB_URI;\nmongoose.connect('mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb', option).then(function(){\n    //connected successfully\n}, function(err) {\n    //err handle\n});\n\napp.use(bodyParser.urlencoded({ extended: true }));\napp.use(bodyParser.json());\n\napp.use(function(req, res, next) {\n  if (req.headers && req.headers.authorization && req.headers.authorization.split(' ')[0] === 'JWT') {\n    jsonwebtoken.verify(req.headers.authorization.split(' ')[1], 'RESTFULAPIs', function(err, decode) {\n      if (err) req.user = undefined;\n      req.user = decode;\n      next();\n    });\n  } else {\n    req.user = undefined;\n    next();\n  }\n});\nvar routes = require('./api/routes/userRoutes');\nroutes(app);\n\napp.use(function(req, res) {\n  res.status(404).send({ url: req.originalUrl + ' not found' })\n});\n\napp.listen(port);\n\nconsole.log(' RESTful API server started on: ' + port);\n\nmodule.exports = app;
\n

Step 9. Now you just need to run the project by using the following command and try logging by using the JWT.

\n
npm start
\n

Step 10. Open Postman and create a post request to localhost:3000/auth/register as below:

\n

\"Postman

\n

Step 11. After this, let’s sign with this URL localhost:3000/auth/sign_in . Enter the keys and values for email and password

\n

\"Postman

\n

Under the value, add JWT and the token with a space between, like so:

\n
JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6Im9sYXR1bmRlZ2FydWJhQGdtYWlsLmNvbSIsImZ1bGxOYW1lIjoiT2xhdHVuZGUgR2FydWJhIiwiX2lkIjoiNThmMjYzNDdiMTY1YzUxODM1NDMxYTNkIiwiaWF0IjoxNDkyMjgwMTk4fQ.VcMpybz08cB5PsrMSr25En4_EwCGWZVFgciO4M-3ENE
\n

Step 11. Then, enter the parameters for the key and value for fetching the profile. You want to create as shown below and send:

\n

\"Postman

\n

As we have seen it is fairly easy to build a JWT authentication system with NodeJS, You can found the complete code used in this tutorial here.

\n","headings":[{"value":"What is JWT?","depth":2},{"value":"Step 2. Install “jsonwebtoken” packageby using following command","depth":4},{"value":"Step 3. Create the user model","depth":4},{"value":"Step 4. Create the user handlers","depth":4},{"value":"Step 7. Add the following code in server.js","depth":4}],"fields":{"slug":"/engineering/nodejs-and-mongodb-application-authentication-by-jwt/"},"frontmatter":{"metatitle":null,"metadescription":null,"description":null,"title":"NodeJS and MongoDB application authentication by JWT","canonical":null,"date":"March 20, 2020","updated_date":null,"tags":["NodeJs","JWT","MongoDB","Authentication","JSON Web Token"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.6666666666666667,"src":"/static/2b39d6f99b1ca5d4bc89d3bfccb6e29d/a27e8/jwt.webp","srcSet":"/static/2b39d6f99b1ca5d4bc89d3bfccb6e29d/1c9b5/jwt.webp 200w,\n/static/2b39d6f99b1ca5d4bc89d3bfccb6e29d/f1752/jwt.webp 400w,\n/static/2b39d6f99b1ca5d4bc89d3bfccb6e29d/a27e8/jwt.webp 500w","sizes":"(max-width: 500px) 100vw, 500px"}}},"author":{"id":"Ashish Sharma","github":"ashish8947","bio":"Ashish is a software engineer who continually seeks clean, elegant solutions to business challenges. His lifelong passion for technology drives him to proactively expand horizons, constantly exploring and evaluating new languages, platforms, frameworks and tools.","avatar":null}}}},"pageContext":{"id":"30bc4404-9225-5434-9fe8-34366bb6a88b","fields__slug":"/engineering/nodejs-and-mongodb-application-authentication-by-jwt/","__params":{"fields__slug":"engineering"}}},"staticQueryHashes":["1171199041","1384082988","1711371485","1753898100","2100481360","229320306","23180105","528864852"]}