DEV Community

Cover image for I built a production-ready MERN boilerplates so you never have to again.
Omkar Karale
Omkar Karale

Posted on

I built a production-ready MERN boilerplates so you never have to again.

#javascript #webdev #node #typescript

Every MERN project starts the same way.

You open a blank Express file. You think "auth can't be that hard." Three days later you're debugging why your refresh token works in Postman but not in the browser, your CSRF middleware is blocking your own requests, and Google OAuth is throwing a redirect URI mismatch at 1 AM.

I've been there. So I built the thing I wished existed.

Introducing MERN Auth Starter — ship auth in 10 minutes, not 5 days

Live demo → secure-authforge

Clone it. Configure three env variables. Run npm install && npm run dev. You have a full production-grade auth system running locally before your coffee gets cold.

What's actually inside

I'm not talking about a tutorial project with jwt.sign() shoved into a route handler. This is the real thing.

Security layer

  • JWT access tokens (15 min expiry) stored in httpOnly cookies — not localStorage, never exposed to JavaScript
  • Refresh token rotation with reuse detection — if a stolen token is used, the entire session is wiped immediately
  • bcrypt password hashing at 12 rounds
  • Google OAuth with CSRF state verification
  • CSRF protection — double-submit cookie pattern on every state-changing route
  • Rate limiting on every auth endpoint — login, register, forgot-password, verify-email
  • Helmet security headers + CORS restricted to your frontend URL
  • Email enumeration protection — login and forgot-password never reveal whether an account exists

Backend

Built with Node.js + Express 5 + TypeScript + MongoDB + Mongoose

  • Email verification flow — Resend in production, auto-falls back to demo mode with zero setup needed
  • Forgot password → reset password → email notification
  • Change password for authenticated users
  • Role-based access control — requireRole("admin") middleware, drop it on any route
  • Middleware stack: verifyToken, requireVerifiedEmail, requireRole
  • Zod validation on every endpoint
  • Audit logging on every auth event

Frontend

Built with React 19 + Vite + Tailwind CSS v4 + TypeScript

  • Zustand auth store — no prop drilling, no Context API spaghetti
  • TanStack Query for server state
  • React Hook Form + Zod — validation that matches the backend exactly
  • Axios interceptors — silent token refresh on 401, zero flicker, user never gets logged out unexpectedly
  • Full page set: Login, Register, Verify Email, Forgot Password, Reset Password, Change Password

Production-ready out of the box

  • 10 integration tests using Node's built-in test runner — zero extra dependencies
  • vercel.json already configured for SPA routing
  • Deploys to Render + Vercel in under 10 minutes
  • Full setup guide included

The demo mode is my favourite part

No Resend account? No problem.

When RESEND_API_KEY is missing, the backend automatically switches to demo mode:

  • Verification links appear directly on screen as a clickable button
  • Password reset links open automatically in the browser
  • The full auth flow works end to end — register, verify, login, reset password — with zero external services

This means a buyer can clone it and have the entire flow running in minutes without signing up for anything. When they're ready for production, they add their Resend key and it just works.

Who this is for

Developers starting a new MERN project who want auth done today, not next week.

Freelancers who configure this for clients and bill $500–$800 per project. At that rate, this pays for itself on the first use.

Students who want a portfolio project backed by the same security patterns used in production apps.

Anyone who has debugged JWT expiry at 2 AM and never wants to do it again.

Tech stack at a glance

Layer Technology
Backend Node.js, Express 5, TypeScript
Database MongoDB + Mongoose
Auth JWT, bcrypt, httpOnly cookies
Email Resend (with demo mode fallback)
Validation Zod — shared frontend + backend
Frontend React 19, Vite, Tailwind CSS v4
State Zustand
Forms React Hook Form + Zod Resolver
Testing Node built-in test runner

What it looks like

Live demo → secure-authforge

Try the full flow:

  1. Register with email
  2. Verify email via the demo link (no inbox needed)
  3. Login
  4. Try Google OAuth
  5. Test forgot password flow

Everything works. No fake buttons.

Get it

→ Get MERN Auth Starter Pack on Gumroad

$79 — personal and commercial use included. Use it in unlimited client projects.
Resale of the source code is not permitted.

One last thing

I built this because I was tired of copy-pasting auth code between projects and fixing the same bugs every time. If that sounds familiar — this is for you.

Questions? Drop them in the comments or drop me an email. I read every message and typically reply within 24 hours.

Built by @ItsOnkar-dev

Top comments (0)