How to Implement User Authentication in Node.js

User authentication is a crucial feature for any web application, allowing you to verify the identity of users and secure sensitive data. In this article, we’ll explore how to implement user authentication in Node.js, guiding you through the necessary steps and providing code snippets to create a robust authentication system.

What is User Authentication?

User authentication is the process of validating a user's identity before granting access to a system. It typically involves verifying credentials such as a username and password. Once authenticated, users can interact with the application based on their permissions.

Use Cases for User Authentication

1. Web Applications: Protecting user accounts and sensitive information.
2. APIs: Ensuring that only authorized clients can access specific resources.
3. Mobile Applications: Managing user sessions and maintaining security on mobile devices.

Setting Up Your Node.js Environment

Before we dive into the code, let’s set up a basic Node.js environment. Ensure you have Node.js installed on your machine. You can check by running:

node -v
npm -v

Step 1: Initialize Your Project

Create a new directory for your project and initialize it:

mkdir user-authentication
cd user-authentication
npm init -y

Step 2: Install Required Packages

We'll need several packages to handle authentication. Install the following dependencies:

npm install express mongoose bcryptjs jsonwebtoken dotenv

• express: A web framework for Node.js.
• mongoose: An ODM (Object Data Modeling) library for MongoDB and Node.js.
• bcryptjs: A library for hashing passwords.
• jsonwebtoken: A library for creating and verifying JSON Web Tokens.
• dotenv: A module to load environment variables from a .env file.

Step 3: Create the Directory Structure

Set up the following directory structure:

user-authentication/
├── .env
├── index.js
└── models/
    └── User.js

Step 4: Create the User Model

Create a User.js file inside the models folder to define the User schema:

// models/User.js
const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  username: {
    type: String,
    required: true,
    unique: true,
  },
  password: {
    type: String,
    required: true,
  },
});

module.exports = mongoose.model('User', userSchema);

Step 5: Connect to MongoDB

In your index.js file, connect to MongoDB and set up the Express application:

// index.js
const express = require('express');
const mongoose = require('mongoose');
const dotenv = require('dotenv');

dotenv.config();

const app = express();
app.use(express.json());

mongoose.connect(process.env.MONGO_URI, { useNewUrlParser: true, useUnifiedTopology: true })
  .then(() => console.log('MongoDB connected'))
  .catch(err => console.error(err));

// Start the server
const PORT = process.env.PORT || 5000;
app.listen(PORT, () => {
  console.log(`Server is running on port ${PORT}`);
});

Make sure to create a .env file in the root of your project with your MongoDB connection string:

MONGO_URI=your_mongodb_connection_string

Step 6: Implement User Registration

Now, let’s implement user registration. Add the following endpoint to index.js:

const User = require('./models/User');
const bcrypt = require('bcryptjs');

app.post('/register', async (req, res) => {
  const { username, password } = req.body;

  // Check if user exists
  const existingUser = await User.findOne({ username });
  if (existingUser) {
    return res.status(400).json({ message: 'User already exists' });
  }

  // Hash the password
  const hashedPassword = await bcrypt.hash(password, 10);

  // Create a new user
  const user = new User({ username, password: hashedPassword });
  await user.save();

  res.status(201).json({ message: 'User registered successfully' });
});

Step 7: Implement User Login

Next, implement the login functionality:

const jwt = require('jsonwebtoken');

app.post('/login', async (req, res) => {
  const { username, password } = req.body;

  // Find the user
  const user = await User.findOne({ username });
  if (!user) {
    return res.status(400).json({ message: 'Invalid credentials' });
  }

  // Check the password
  const isMatch = await bcrypt.compare(password, user.password);
  if (!isMatch) {
    return res.status(400).json({ message: 'Invalid credentials' });
  }

  // Generate a token
  const token = jwt.sign({ id: user._id, username: user.username }, process.env.JWT_SECRET, { expiresIn: '1h' });

  res.json({ token });
});

Step 8: Protecting Routes with Middleware

To protect certain routes, you can create middleware to verify the JWT:

const authenticateToken = (req, res, next) => {
  const token = req.headers['authorization'];
  if (!token) return res.sendStatus(401);

  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
};

// Protecting a route
app.get('/protected', authenticateToken, (req, res) => {
  res.json({ message: 'This is a protected route', user: req.user });
});

Step 9: Testing Your Authentication System

You can test your authentication system using tools like Postman or cURL. Start your server:

node index.js

• Register a User: Make a POST request to /register with a JSON body containing username and password.
• Login a User: Make a POST request to /login with the same credentials to receive a JWT.
• Access Protected Route: Use the token received from login to access the /protected route by including it in the Authorization header.

Conclusion

Implementing user authentication in Node.js is a fundamental skill for building secure applications. By following the steps outlined in this article, you can create a robust authentication system using Express, MongoDB, and JWT. Always remember to keep security best practices in mind, such as hashing passwords and using HTTPS in production environments. Happy coding!