DEV Community: Ajit Forger

MySQL Views: Your Database's Secret Weapon for Clean, Smart Queries 🎯

Ajit Forger — Tue, 26 May 2026 10:32:12 +0000

Ever found yourself writing the same complex JOIN query for the hundredth time? Or wished you could hide the scary complexity of your database from your frontend team? Welcome to the wonderful world of MySQL Views – your database's Swiss Army knife that's been waiting patiently for you to discover it!

Think of views as your database's personal assistant. They take those gnarly, multi-table queries and wrap them up in a neat, reusable package that you can call with a simple SELECT. It's like having a shortcut to your most complicated data relationships, but way cooler.

What Exactly Are Views? 🤔

A view in MySQL is essentially a virtual table created from the result of a SQL statement. It's not storing data itself (well, mostly – we'll get to materialized views later), but it's storing a query that gets executed whenever you call the view.

Picture this: instead of writing this monster query every time:

-- The query that haunts your dreams
SELECT 
    u.id,
    u.name,
    u.email,
    p.company_name,
    COUNT(o.id) as total_orders,
    SUM(o.total_amount) as total_spent,
    CASE 
        WHEN SUM(o.total_amount) > 10000 THEN 'VIP'
        WHEN SUM(o.total_amount) > 5000 THEN 'Premium'
        ELSE 'Regular'
    END as customer_tier
FROM users u
LEFT JOIN profiles p ON u.id = p.user_id
LEFT JOIN orders o ON u.id = o.user_id 
    AND o.status = 'completed'
    AND o.created_at >= DATE_SUB(NOW(), INTERVAL 1 YEAR)
GROUP BY u.id, u.name, u.email, p.company_name;

You can create a view and just do this:

-- Create the view once
CREATE VIEW customer_summary AS (
    -- Insert that monster query here
);

-- Use it anywhere, anytime
SELECT * FROM customer_summary WHERE customer_tier = 'VIP';

Magic, right? ✨

Creating Your First View: Baby Steps 👶

Let's start with something simple. Say you have a users table and you constantly need to get active users with their full information:

-- Basic view creation
CREATE VIEW active_users AS
SELECT 
    id,
    CONCAT(first_name, ' ', last_name) as full_name,
    email,
    created_at,
    last_login
FROM users 
WHERE status = 'active' 
    AND deleted_at IS NULL;

-- Now use it like any table
SELECT * FROM active_users WHERE last_login > DATE_SUB(NOW(), INTERVAL 30 DAY);

Boom! You've just created your first view. Pat yourself on the back – you're officially a view wizard now! 🧙‍♂️

View Types: Choose Your Fighter 🥊

1. Simple Views (The Friendly Neighborhood View)

These are straightforward, single-table views that are perfect for filtering and formatting:

-- Hide sensitive columns and add computed fields
CREATE VIEW public_user_info AS
SELECT 
    id,
    username,
    CONCAT(first_name, ' ', SUBSTRING(last_name, 1, 1), '.') as display_name,
    DATE_FORMAT(created_at, '%M %Y') as member_since,
    CASE 
        WHEN last_login > DATE_SUB(NOW(), INTERVAL 7 DAY) THEN 'Recently Active'
        WHEN last_login > DATE_SUB(NOW(), INTERVAL 30 DAY) THEN 'Active'
        ELSE 'Inactive'
    END as activity_status
FROM users
WHERE status != 'banned';

2. Complex Views (The Data Relationship Masters)

These bad boys handle multiple tables and complex logic:

-- Product performance dashboard view
CREATE VIEW product_performance AS
SELECT 
    p.id,
    p.name,
    p.category,
    COUNT(DISTINCT o.user_id) as unique_customers,
    COUNT(oi.id) as total_sold,
    SUM(oi.quantity * oi.price) as total_revenue,
    AVG(r.rating) as avg_rating,
    COUNT(r.id) as review_count
FROM products p
LEFT JOIN order_items oi ON p.id = oi.product_id
LEFT JOIN orders o ON oi.order_id = o.id AND o.status = 'completed'
LEFT JOIN reviews r ON p.id = r.product_id
GROUP BY p.id, p.name, p.category;

3. Updatable Views (The Shape-Shifters)

Not all views are read-only! Some views can be updated, and the changes flow through to the underlying tables:

-- Simple updatable view
CREATE VIEW current_inventory AS
SELECT 
    id,
    product_name,
    quantity_in_stock,
    reorder_level,
    last_updated
FROM inventory 
WHERE active = 1;

-- You can actually update through this view!
UPDATE current_inventory 
SET quantity_in_stock = quantity_in_stock - 5 
WHERE id = 123;

Rules for updatable views (MySQL is picky about this):

Must reference only one table
No aggregate functions (COUNT, SUM, etc.)
No DISTINCT, GROUP BY, HAVING, or UNION
No subqueries in the SELECT list

Advanced View Techniques: Level Up! 🚀

WITH CHECK OPTION: The Bouncer

Want to make sure updates through your view follow the rules? Use WITH CHECK OPTION:

CREATE VIEW premium_customers AS
SELECT * FROM customers 
WHERE customer_tier = 'premium'
WITH CHECK OPTION;

-- This will fail because it violates the view's WHERE condition
UPDATE premium_customers SET customer_tier = 'regular' WHERE id = 1;

Recursive Views: Mind = Blown 🤯

MySQL supports recursive views for hierarchical data:

CREATE VIEW category_hierarchy AS
WITH RECURSIVE cte AS (
    -- Base case: top-level categories
    SELECT id, name, parent_id, 0 as level, name as path
    FROM categories 
    WHERE parent_id IS NULL

    UNION ALL

    -- Recursive case: child categories
    SELECT c.id, c.name, c.parent_id, cte.level + 1,
           CONCAT(cte.path, ' > ', c.name) as path
    FROM categories c
    JOIN cte ON c.parent_id = cte.id
)
SELECT * FROM cte;

Security Views: Fort Knox for Your Data 🔒

Use views to create secure, role-based data access:

-- HR can see salary info
CREATE VIEW hr_employee_view AS
SELECT 
    id, name, department, position, salary, hire_date
FROM employees;

-- Managers can see team info but not salaries
CREATE VIEW manager_employee_view AS
SELECT 
    id, name, department, position, hire_date, performance_rating
FROM employees;

-- General staff can see basic directory info
CREATE VIEW directory_view AS
SELECT 
    name, department, position, email, phone
FROM employees 
WHERE status = 'active';

Managing Views Like a Pro 💪

View Information Schema: Your View Inspector

-- See all views in your database
SELECT 
    table_name as view_name,
    view_definition,
    definer,
    security_type
FROM information_schema.views 
WHERE table_schema = 'your_database';

-- Check if a view is updatable
SELECT 
    table_name,
    is_updatable
FROM information_schema.views 
WHERE table_schema = 'your_database';

Modifying Views: The Right Way

-- Replace an existing view (safer than DROP + CREATE)
CREATE OR REPLACE VIEW customer_summary AS
SELECT 
    id,
    name,
    email,
    -- Added new computed column
    DATEDIFF(NOW(), created_at) as days_as_customer,
    total_orders,
    total_spent
FROM (
    -- Your complex subquery here
) as base_query;

-- Drop a view when you're done with it
DROP VIEW IF EXISTS old_unused_view;

Performance Considerations: Keep It Snappy ⚡

The Good News

Views don't store data (usually), so they don't take up storage space. They're just stored queries that get executed when called.

The Reality Check

Every time you query a view, MySQL executes the underlying query. Complex views can be slow, especially with multiple joins and aggregations.

-- This view might be slow if you have millions of records
CREATE VIEW slow_customer_analysis AS
SELECT 
    u.id,
    u.name,
    COUNT(DISTINCT o.id) as total_orders,
    COUNT(DISTINCT p.id) as products_bought,
    AVG(r.rating) as avg_rating_given,
    -- ... many more complex calculations
FROM users u
LEFT JOIN orders o ON u.id = o.user_id
LEFT JOIN order_items oi ON o.id = oi.order_id
LEFT JOIN products p ON oi.product_id = p.id
LEFT JOIN reviews r ON u.id = r.user_id
GROUP BY u.id, u.name;

Performance Tips:

Index the underlying tables properly
Use LIMIT when testing complex views
Consider materialized views for heavy analytics (more on this below)
Profile your views with EXPLAIN

Materialized Views: The Storage Heroes 📦

MySQL doesn't have built-in materialized views, but you can create your own:

-- Create a table to store materialized view data
CREATE TABLE mv_daily_sales (
    sale_date DATE PRIMARY KEY,
    total_orders INT,
    total_revenue DECIMAL(10,2),
    avg_order_value DECIMAL(8,2),
    unique_customers INT,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
);

-- Populate it with a stored procedure
DELIMITER //
CREATE PROCEDURE RefreshDailySales()
BEGIN
    DELETE FROM mv_daily_sales WHERE sale_date = CURDATE();

    INSERT INTO mv_daily_sales (sale_date, total_orders, total_revenue, avg_order_value, unique_customers)
    SELECT 
        DATE(created_at) as sale_date,
        COUNT(*) as total_orders,
        SUM(total_amount) as total_revenue,
        AVG(total_amount) as avg_order_value,
        COUNT(DISTINCT user_id) as unique_customers
    FROM orders 
    WHERE DATE(created_at) = CURDATE()
        AND status = 'completed'
    GROUP BY DATE(created_at);
END //
DELIMITER ;

-- Set up a scheduled event to refresh it
CREATE EVENT refresh_daily_sales
ON SCHEDULE EVERY 1 HOUR
DO CALL RefreshDailySales();

View Best Practices: The Wisdom 🧠

Do's ✅

Use descriptive names: active_premium_customers is better than view1
Document complex views: Add comments explaining the business logic
Keep security in mind: Views can expose data you don't intend to
Test performance: Profile your views, especially complex ones
Version control: Treat view definitions like code

Don'ts ❌

Don't create views on views on views: Keep the nesting reasonable
Don't forget about indexes: Views still need properly indexed underlying tables
*Don't use SELECT **: Be explicit about columns in production views
Don't ignore security: Views inherit permissions from underlying tables

Golden Rules:

-- Good view: Explicit, documented, purposeful
CREATE VIEW monthly_revenue_summary AS
/* Business Logic: Calculate monthly revenue metrics for dashboard
   Updated: 2024-01-15
   Owner: Finance Team */
SELECT 
    YEAR(order_date) as revenue_year,
    MONTH(order_date) as revenue_month,
    MONTHNAME(order_date) as month_name,
    COUNT(*) as total_orders,
    SUM(total_amount) as total_revenue,
    AVG(total_amount) as avg_order_value
FROM orders 
WHERE status = 'completed' 
    AND order_date >= DATE_SUB(CURDATE(), INTERVAL 24 MONTH)
GROUP BY YEAR(order_date), MONTH(order_date)
ORDER BY revenue_year DESC, revenue_month DESC;

Real-World Use Cases: Where Views Shine ⭐

1. API Data Layer

-- Clean API response format
CREATE VIEW api_user_profile AS
SELECT 
    id,
    username,
    email,
    JSON_OBJECT(
        'firstName', first_name,
        'lastName', last_name,
        'avatar', avatar_url,
        'memberSince', DATE_FORMAT(created_at, '%Y-%m-%d')
    ) as profile_data,
    status
FROM users 
WHERE status = 'active' AND deleted_at IS NULL;

2. Reporting Dashboard

-- Executive dashboard view
CREATE VIEW executive_dashboard AS
SELECT 
    'Today' as period,
    COUNT(*) as new_orders,
    SUM(total_amount) as revenue,
    COUNT(DISTINCT user_id) as active_customers
FROM orders 
WHERE DATE(created_at) = CURDATE()

UNION ALL

SELECT 
    'This Week' as period,
    COUNT(*) as new_orders,
    SUM(total_amount) as revenue,
    COUNT(DISTINCT user_id) as active_customers
FROM orders 
WHERE created_at >= DATE_SUB(CURDATE(), INTERVAL 7 DAY);

3. Data Privacy Compliance

-- GDPR-compliant customer data view
CREATE VIEW gdpr_customer_export AS
SELECT 
    id,
    email,
    created_at,
    last_login,
    CASE 
        WHEN gdpr_consent = 1 THEN 'Consented'
        ELSE 'No Consent'
    END as consent_status,
    -- Anonymized or aggregated data only
    JSON_OBJECT(
        'totalOrders', (SELECT COUNT(*) FROM orders WHERE user_id = users.id),
        'accountAge', DATEDIFF(NOW(), created_at)
    ) as summary_data
FROM users;

Troubleshooting Views: When Things Go Wrong 🔧

Common Issues and Fixes:

Error: "The user specified as a definer does not exist"

-- Fix: Update the definer
ALTER DEFINER = CURRENT_USER VIEW your_view_name AS
SELECT * FROM your_table;

Performance Issues:

-- Debug with EXPLAIN
EXPLAIN SELECT * FROM your_slow_view WHERE some_condition = 'value';

-- Check underlying table indexes
SHOW INDEX FROM underlying_table;

View Dependency Hell:

-- See view dependencies
SELECT 
    table_name,
    view_definition 
FROM information_schema.views 
WHERE view_definition LIKE '%your_table_name%';

The View Philosophy: Final Words 🎭

Views are more than just query shortcuts – they're a philosophy of database design. They represent the idea that your database should serve your application, not the other way around. They're about creating clean abstractions, maintaining security boundaries, and making complex data relationships feel simple.

Here's the thing: views won't solve all your database problems, but they'll make your life significantly easier when used thoughtfully. They're like a good pair of sunglasses – you don't realize how much you needed them until you start wearing them.

Your View Journey Checklist:

✅ Start with simple, single-table views
✅ Graduate to complex multi-table joins
✅ Experiment with updatable views
✅ Build security-focused views for different user roles
✅ Create reporting views for dashboards
✅ Consider materialized views for heavy analytics
✅ Always document your business logic
✅ Profile and optimize for performance

Remember: the best view is the one that makes your future self say "Past me was brilliant!" instead of "What the heck was Past me thinking?!"

Now go forth and view responsibly! Your database (and your teammates) will thank you. 🙌

Happy querying, and may your JOINs be ever fast and your views forever clear! ✨

Building Authentication Systems in Nest.js: A Complete Guide

Ajit Forger — Tue, 26 May 2026 10:22:17 +0000

Authentication is one of the most critical aspects of any modern web application. Without a solid auth system, your app is like a house with an open door. If you’re building with Nest.js, you already have a framework that prioritizes structure, scalability, and developer experience. Now, let’s see how to implement a robust authentication system in Nest.js — from the fundamentals to advanced practices.

Why Nest.js for Authentication?

Nest.js is built on top of Express (or optionally Fastify) and leverages TypeScript, decorators, and dependency injection. This makes it an excellent candidate for handling authentication because:

It integrates well with Passport.js, a popular authentication middleware.
Its modular architecture allows you to isolate auth logic in a clean, reusable way.
It supports advanced patterns like guards, interceptors, and custom strategies.

Core Building Blocks of Auth in Nest.js

Before diving into code, let’s break down the components involved:

Auth Module – A dedicated module to manage authentication.
User Module – Handles user creation, persistence, and retrieval.
Guards – Control access to routes by verifying authentication.
Strategies – Define how authentication is performed (JWT, sessions, OAuth, etc.).
Decorators – For extracting authenticated user info easily (e.g., @User() decorator).

Step 1: Setting Up the Project

First, create a fresh Nest.js project if you don’t already have one:

npm i -g @nestjs/cli
nest new auth-demo

Then, install the required dependencies for JWT-based authentication:

npm install @nestjs/passport passport passport-local passport-jwt bcrypt @nestjs/jwt
npm install --save-dev @types/passport-local @types/passport-jwt

Step 2: Creating the Auth Module

Nest encourages modular design, so let’s generate an auth module:

nest g module auth
nest g service auth
nest g controller auth

You’ll also need a users module to manage user data:

nest g module users
nest g service users

Step 3: Implementing User Service

Your UserService should handle user lookups and persistence. For simplicity, let’s mock it with in-memory users:

// users/users.service.ts
import { Injectable } from '@nestjs/common';

export type User = any;

@Injectable()
export class UsersService {
  private readonly users = [
    {
      userId: 1,
      username: 'ajit',
      password: 'password123', // in real life -> hashed!
    },
  ];

  async findOne(username: string): Promise<User | undefined> {
    return this.users.find(user => user.username === username);
  }
}

⚠️ Note: Never store plaintext passwords. Always hash using bcrypt.

Step 4: Local Strategy (Login with Username & Password)

Nest.js uses Passport strategies. Let’s implement a Local Strategy:

// auth/local.strategy.ts
import { Strategy } from 'passport-local';
import { PassportStrategy } from '@nestjs/passport';
import { Injectable, UnauthorizedException } from '@nestjs/common';
import { AuthService } from './auth.service';

@Injectable()
export class LocalStrategy extends PassportStrategy(Strategy) {
  constructor(private authService: AuthService) {
    super(); // default expects 'username' and 'password'
  }

  async validate(username: string, password: string): Promise<any> {
    const user = await this.authService.validateUser(username, password);
    if (!user) {
      throw new UnauthorizedException();
    }
    return user;
  }
}

Step 5: Auth Service

The AuthService validates users and issues JWTs:

// auth/auth.service.ts
import { Injectable } from '@nestjs/common';
import { UsersService } from '../users/users.service';
import { JwtService } from '@nestjs/jwt';

@Injectable()
export class AuthService {
  constructor(
    private usersService: UsersService,
    private jwtService: JwtService,
  ) {}

  async validateUser(username: string, pass: string): Promise<any> {
    const user = await this.usersService.findOne(username);
    if (user && user.password === pass) {
      const { password, ...result } = user;
      return result;
    }
    return null;
  }

  async login(user: any) {
    const payload = { username: user.username, sub: user.userId };
    return {
      access_token: this.jwtService.sign(payload),
    };
  }
}

Step 6: JWT Strategy

To protect routes, we need a JWT strategy:

// auth/jwt.strategy.ts
import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: 'SECRET_KEY', // Use env vars in prod!
    });
  }

  async validate(payload: any) {
    return { userId: payload.sub, username: payload.username };
  }
}

Step 7: Auth Module Configuration

Wire everything up in AuthModule:

// auth/auth.module.ts
import { Module } from '@nestjs/common';
import { AuthService } from './auth.service';
import { UsersModule } from '../users/users.module';
import { PassportModule } from '@nestjs/passport';
import { JwtModule } from '@nestjs/jwt';
import { LocalStrategy } from './local.strategy';
import { JwtStrategy } from './jwt.strategy';
import { AuthController } from './auth.controller';

@Module({
  imports: [
    UsersModule,
    PassportModule,
    JwtModule.register({
      secret: 'SECRET_KEY', // move to process.env
      signOptions: { expiresIn: '60m' },
    }),
  ],
  providers: [AuthService, LocalStrategy, JwtStrategy],
  controllers: [AuthController],
})
export class AuthModule {}

Step 8: Auth Controller

Expose login and protected routes:

// auth/auth.controller.ts
import { Controller, Request, Post, UseGuards, Get } from '@nestjs/common';
import { AuthService } from './auth.service';
import { LocalAuthGuard } from './local-auth.guard';
import { JwtAuthGuard } from './jwt-auth.guard';

@Controller('auth')
export class AuthController {
  constructor(private authService: AuthService) {}

  @UseGuards(LocalAuthGuard)
  @Post('login')
  async login(@Request() req) {
    return this.authService.login(req.user);
  }

  @UseGuards(JwtAuthGuard)
  @Get('profile')
  getProfile(@Request() req) {
    return req.user;
  }
}

Step 9: Guards

Create guards to wrap around the strategies:

// auth/local-auth.guard.ts
import { Injectable } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Injectable()
export class LocalAuthGuard extends AuthGuard('local') {}

// auth/jwt-auth.guard.ts
import { Injectable } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Injectable()
export class JwtAuthGuard extends AuthGuard('jwt') {}

Step 10: Testing

Login:

   POST /auth/login
   { "username": "ajit", "password": "password123" }

→ Returns { "access_token": "..." }

Access Profile:

   GET /auth/profile
   Authorization: Bearer <access_token>

→ Returns { "userId": 1, "username": "ajit" }

Best Practices

Never store plaintext passwords — always hash with bcrypt.
Use environment variables for secrets and config.
Implement refresh tokens for long-lived sessions.
Add role-based access control (RBAC) using custom decorators and guards.
Consider OAuth2 or SSO for enterprise-level apps.

Conclusion

Nest.js makes authentication clean and maintainable thanks to its modular structure and Passport integration. With just a few steps, we set up a system that supports local login and JWT-protected routes. From here, you can extend it with refresh tokens, roles, or third-party providers like Google or GitHub.

Building Refreshing JWT Tokens in Node.js: A Complete Guide

Ajit Forger — Fri, 12 Sep 2025 20:09:41 +0000

When you’re building authentication in a Node.js application, JSON Web Tokens (JWTs) are one of the most common approaches. They’re fast, stateless, and easy to work with. But they also come with a catch: expiration. If you issue a short-lived token (say, 15 minutes), users get logged out too often. If you issue a long-lived token (say, 7 days), it increases security risks if the token leaks.

That’s where refresh tokens come in.

We’ll break down how JWT and refresh tokens work together, why you need them, and how to implement a secure refresh token strategy in Node.js.

🔑 What Are Refresh Tokens?

A JWT access token is used to authenticate requests. It’s short-lived, usually 10–30 minutes, to minimize risk.

A refresh token is a long-lived credential (days or weeks) that lets the client request a new access token without logging in again.

Access Token → Fast, stateless, expires quickly.
Refresh Token → Long-lived, securely stored, used only to renew access tokens.

🛠️ Project Setup

Let’s spin up a minimal Express.js app with JWT authentication and refresh tokens.

1. Install Dependencies

npm init -y
npm install express jsonwebtoken bcryptjs cookie-parser dotenv

express → Web framework
jsonwebtoken → For signing/verifying JWTs
bcryptjs → For password hashing
cookie-parser → To handle cookies (where refresh tokens can be stored)
dotenv → Manage environment variables

⚙️ Basic Server Setup

// server.js
const express = require("express");
const jwt = require("jsonwebtoken");
const bcrypt = require("bcryptjs");
const cookieParser = require("cookie-parser");
require("dotenv").config();

const app = express();
app.use(express.json());
app.use(cookieParser());

const PORT = process.env.PORT || 5000;
app.listen(PORT, () => console.log(`Server running on ${PORT}`));

🔐 Generating Tokens

We’ll need two token generators:

generateAccessToken(user) → short-lived (e.g., 15m)
generateRefreshToken(user) → long-lived (e.g., 7d)

function generateAccessToken(user) {
  return jwt.sign({ id: user.id, email: user.email }, process.env.ACCESS_SECRET, {
    expiresIn: "15m",
  });
}

function generateRefreshToken(user) {
  return jwt.sign({ id: user.id, email: user.email }, process.env.REFRESH_SECRET, {
    expiresIn: "7d",
  });
}

👤 Login Route

When a user logs in, we issue both tokens:

const users = []; // mock DB

app.post("/register", async (req, res) => {
  const { email, password } = req.body;
  const hashed = await bcrypt.hash(password, 10);
  users.push({ id: users.length + 1, email, password: hashed });
  res.json({ message: "User registered" });
});

app.post("/login", async (req, res) => {
  const { email, password } = req.body;
  const user = users.find(u => u.email === email);
  if (!user) return res.status(400).json({ error: "User not found" });

  const valid = await bcrypt.compare(password, user.password);
  if (!valid) return res.status(400).json({ error: "Invalid password" });

  const accessToken = generateAccessToken(user);
  const refreshToken = generateRefreshToken(user);

  // Store refresh token in HttpOnly cookie
  res.cookie("refreshToken", refreshToken, {
    httpOnly: true,
    secure: true, // enable in production (https)
    sameSite: "strict",
  });

  res.json({ accessToken });
});

🔄 Refreshing Tokens

Now, we add a /refresh endpoint to issue a new access token when the old one expires.

app.post("/refresh", (req, res) => {
  const token = req.cookies.refreshToken;
  if (!token) return res.status(401).json({ error: "No token provided" });

  jwt.verify(token, process.env.REFRESH_SECRET, (err, user) => {
    if (err) return res.status(403).json({ error: "Invalid token" });

    const newAccessToken = generateAccessToken(user);
    res.json({ accessToken: newAccessToken });
  });
});

🔒 Middleware to Protect Routes

function authMiddleware(req, res, next) {
  const authHeader = req.headers["authorization"];
  const token = authHeader && authHeader.split(" ")[1];
  if (!token) return res.sendStatus(401);

  jwt.verify(token, process.env.ACCESS_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
}

app.get("/protected", authMiddleware, (req, res) => {
  res.json({ message: "You are authorized!", user: req.user });
});

🚪 Logout

To log out, just clear the refresh token.

app.post("/logout", (req, res) => {
  res.clearCookie("refreshToken");
  res.json({ message: "Logged out" });
});

⚠️ Security Best Practices

Store access token in memory (not localStorage/sessionStorage).

Store refresh token in HttpOnly cookie → protects against XSS.

Rotate refresh tokens → issue a new refresh token each time it’s used.

Blacklist old refresh tokens if you want full control (store them in Redis or DB).

Use HTTPS in production to prevent token leaks.

🔄 Refreshing Tokens - Analogy

Here’s how it maps to frontend-backend requests:

Login:

Frontend sends your username/password.
Backend checks credentials and gives you:
- A short-lived access token (movie ticket)
- A long-lived refresh token (season pass, stored in an HttpOnly cookie).

Accessing protected routes:

Frontend attaches the access token in the request headers.
Backend verifies it. If valid → allows access.

Access token expires:

Frontend tries to make a request → gets 401 Unauthorized.
Frontend then calls /refresh without sending username/password, only letting the browser send the refresh token cookie automatically.

Backend verifies refresh token:

If valid → issues a new access token (new movie ticket).
If invalid/expired → user must log in again (season pass expired).

Key point:
The frontend never has direct access to the refresh token if you store it in an HttpOnly cookie. It just “trusts the browser” to send it along with /refresh requests. This keeps it safe from malicious scripts.

🎯 Conclusion

Using refresh tokens with JWTs balances security and usability. You get short-lived access tokens for protection and long-lived refresh tokens for convenience. In production, always handle refresh token storage carefully, implement rotation, and combine with HTTPS for a secure system.

This setup is scalable, works well with stateless services, and is widely used in modern authentication systems.

Understanding of CommonJS(Basics Node.js Series)

Ajit Forger — Wed, 08 Nov 2023 16:27:46 +0000

Hope you all are doing well,

In this micro article, we can understand what synchronous loading is, it's a basics concept of Node.js, which it's uses the Commons module systems.

So, before that, let's talk about CommonJs module systems.

CommonJS module systems

CommonJS modules are the module system for javascript programming language which is used in server-side and non-browser environments such as Node.js

CommonJs modules allow us to organize our code, make it reusable by its characteristics of encapsulation which is where we can make easier to manage and maintain large codebases.

Characteristics of CommonJs modules

Encapsulation

One of the key characteristics of CommonJs modules are it's encapsulation units
it's encapsulating the code and data, preventing them to interfere with other modules
This encapsulation is achieved by using of closures, which isolates the module scope

Exports and Require

Modules can export specific values, functions or objects so this way it can be available to other modules, by exports or module.exports object.

Synchronous Loading

CommonJS modules are loaded synchronously, to explain if a module required then, the entire modules and it's dependencies are loaded and executed before the program continues.

So, in this way programs executes by in order, order of execution

Conclusion

So, Thats its guys for now, Commons modules have more characteristics but for now we are cover some main characteristics, later we explore deep dive into their characteristics with examples to understand better.

Stay tuned for more advanced articles where we'll explore the depths of Node.js
If you have any queries or just want to share your Node.js anecdotes, and command below

happy coding! 🚀🐉💻

Node.js modules (Basics Node.js Series)

Ajit Forger — Wed, 08 Nov 2023 15:55:27 +0000

Nodejs modules are fundamentals concepts in the Node.js that enable you to organize and re-use code.

It's allowed you to break the code into smaller and manageable pieces.
Making easier to maintain and collaborate.
Modules helps you to encapsulate the code, so you can import and use it on other parts of your application.
Without creating a global variable or causing naming conflicts

it's very fundamental mostly used to create a clean structure of our projects.
we are using this CommonJS Modules lot in our Nodejs Projects
like creating a service

Eg, We can write a separate file for getting current currency conversion rates, get dates, day and mostly often for the configs, constants we can use these modules to store site configs constants etc...

*like for the constants *

LANG="en" CURRENCY="usd" BASEURL="yourbaseurl.com"

CommonJS Modules

Nodejs uses CommonJS module system, which defines a way to create, import and export modules.

CommonJS modules have two important main components.

You can export functions, variables or objects using modules.exports or exports object.

//Space.js

module.exports = {
   rocketFunction: function () {
      return "Rocket launched!";
   },
   Moon: 1
};

Importing Modules

You can import the exported content from another module using require function.

Const spaceFun = require(‘space.js’)

spaceFun.rocketFunction()

spaceFun.moon

Output

Rocket launched!
1

Another Example

Get export multiple modules.

// userInfo.js

// A function that greets the user with a personalized message
function greetUser(name) {
   return `Hello, ${name}! Welcome to my module.`;
}

// An object containing some module information
const moduleInfo = {
   moduleName: "My Node.js Module",
   author: "John Doe",
   description: "This is a simple Node.js module example.",
   version: "1.0.0"
};

// Exporting the greetUser function and moduleInfo object
module.exports = {
   greetUser,
   moduleInfo
};

Importing Modules

const userInfo = require('./info.js'); 

console.log(userInfo.greetUser("John")); 
// Output: "Hello, John! Welcome."

console.log(userInfo.moduleInfo); 
// Output: Object with module information

console.log(userInfo.moduleInfo.author); 
// Output: Get author value in module information Object it will outputs "John Doe"

Make use of, Another example

//shuffleArray.js
function shuffleArray(array) {
  for (let i = array.length - 1; i > 0; i--) {
    const j = Math.floor(Math.random() * (i + 1));
    [array[i], array[j]] = [array[j], array[i]];
  }
  return array;
}

module.exports = {
  shuffleArray,
};

Importing Module

const shuffleArray = require("./shuffleArray");

const colors = ["red", "green", "blue", "yellow", "purple"];

console.log("shuffleArray ", shuffleArray.mixArray(colors));

Output(may):
["green", "red", "blue", "purple", "yellow"]

So, That's were you can import the modules

Stay tuned for more advanced articles where we'll explore the depths of Node.js

If you have any queries or just want to share your Node.js anecdotes, and command below

happy coding! 🚀

Useful NPM scripts, Example usage(Basics Node.js Series)

Ajit Forger — Mon, 30 Oct 2023 12:32:42 +0000

Hi hello world, In this micro article we'll explore some essential NPM scripts that will help you kickstart your Node.js journey

As you embark on your journey to master Node.js

Managing your project, dependencies, and automating common tasks is an essential part of the process

NPM scripts are the initial and fundamental step to mastering Node.js, enabling you to streamline your development workflow and make your projects more efficient

An intro to the Npm scripts

Npm scripts in Node.js are a powerful and convenient way to automate various tasks
They are defined in "package.json" file under "scripts"

These scripts allow you to run a common development and build tasks with simple commands.

Example script definitions



"scripts": {
  "start": "node app.js",
  "test": "mocha test/*.js",
  "build": "webpack"
}

Here are some examples of useful NPM scripts you can include in your package.json file

1. Start your application

You can start your application by using npm start here's a basic example of how to start a script



"scripts": {
  "start": "node server.js"
}

2. Auto reloading with nodemon

Development server like Express.js and want it to restart whenever you make changes



"scripts": {
  "dev": "nodemon server.js"
}

3. Running tests

Testing framework like Mocha, you can set up a script for running tests.



"scripts": {
  "test": "mocha"
}

4. Linting our code

Using a linter like ESLint, you can create a script for code linting.



"scripts": {
  "lint": "eslint ."
}

5. Building your project(eg. webpack/babel)

Project requires a build step, such as transpiling or bundling, you can create a script for that (if needed)



"scripts": {
  "build": "webpack"
}

6. Running a custom task

You can define custom scripts for specific tasks, such as data migrations, or generating documentation



"scripts": {
  "migrate": "node db-migration.js",
  "generate-docs": "jsdoc --configure .jsdoc.json"
}

7. Run multiple scripts

At some point we might need to be run a multiple scripts, for that, use the concurrently package to run multiple scripts simultaneously.



"scripts": {
  "dev": "concurrently \"npm run server\" \"npm run client\"",
  "server": "nodemon server.js",
  "client": "webpack --watch"
}

8. Clean the build directory

If you have a build directory that you want to clean before rebuilding



"scripts": {
  "clean": "rm -rf dist",
  "build": "npm run clean && webpack"
}

Use npm run clean to remove the "dist" directory before running the build script.

Bouns (example script)

Custom report generation

If you need to generate custom reports or exports, you can create a script for that



// generate-report.js
const reportGenerator = require('./report-generator');

reportGenerator.generateReport()
    .then(() => {
        console.log('Report generated successfully.');
        process.exit(0);
    })
    .catch((error) => {
        console.error('Report generation failed:', error);
        process.exit(1);
    });

Calling the file



"scripts": {
   "generate-report": "node generate-report.js"
}

npm generate-report, command to run the script

Another Example (useful script), Currency converter

Get exchange rates using exchangeratesapi and using npm custom scripts to get exchange rates on command line

Create a new JavaScript file named currencyConverter.js
Install the axios package to make HTTP requests
Create an account on https://exchangeratesapi.io/ and replace the apikey



const axios = require("axios");

async function convertCurrency(amount, fromCurrency, toCurrency) {
  try {
    const response = await axios.get(
      `https://api.apilayer.com/exchangerates_data/latest?base=${fromCurrency}&symbols=${toCurrency}`,
      {
        headers: {
          Authorization: "Bearer [YOUR_API_KEY]",
        },
      }
    );

    const conversionRate = response.data.rates[toCurrency];
    if (!conversionRate) {
      console.log(
        `Currency conversion from ${fromCurrency} to ${toCurrency} is not supported.`
      );
      return;
    }

    const convertedAmount = amount * conversionRate;
    console.log(
      `${amount} ${fromCurrency} is equivalent to ${convertedAmount} ${toCurrency}`
    );
  } catch (error) {
    console.error("Error fetching exchange rates:", error.message);
  }
}

const args = process.argv.slice(2);
if (args.length !== 3) {
  console.log(
    "Usage: node currencyConverter.js <amount> <fromCurrency> <toCurrency>"
  );
  process.exit(1);
}

const amount = parseFloat(args[0]);
const fromCurrency = args[1].toUpperCase();
const toCurrency = args[2].toUpperCase();

convertCurrency(amount, fromCurrency, toCurrency);

In your package.json, add the script



"scripts": {
   "currency-convert": "node currencyConverter.js"
}

Now, you can run the currency conversion script using the npm run currency-convert

npm run currency-convert 560 INR USD

Conclusion

Now that you've dipped your toes into the whimsical world of NPM scripts, Stay tuned for more advanced articles where we'll explore the depths of Node.js

If you have any queries or just want to share your Node.js anecdotes, and command below

happy coding! 🚀🐉💻