DEV Community

🛑 You don't need passport.js - Guide to node.js authentication ✌️

Sam on May 31, 2019

Originally posted on softwareontheroad.com Introduction While third-party authentication services like Google Firebase, AWS Cognito, an...

Read full post

Cyril Trosset • Sep 4 '19

Hi there,
Thanks for your article.

Why would you save the salt in database? It's not used anywhere after saving as argon2 saves it on its own.

I have also implemented refresh tokens to minimize impact of tokens steal and restrict access to only one device.

Thanks

Tomas Agustin • Jun 6

I would like to know it too.
Please Sam, answer us! :P

Jakub Sarnowski • Jun 1 '19 • Edited

Using JWTs for sessions is not a good idea unless you're on a microservice architecture and are communicating with multiple APIs with the same token. Otherwise, plain old sessions would be a lot better.

For more information and arguments, check out this post.

Sam • Jun 2 '19

Sure, using JWT has its cons, like how to handle JWT steal, the system has to have a sort of 'black-list' feature to revoke those access, that implies keep track of generated JWTs and create a list in Redis or Memcache. Or using a unique secret to sign the JWT for every user, and change it.

In a future article of this series, I'll talk about using sessions and it's advantages.

Thanks for reading!

Jakub Sarnowski • Jun 2 '19

Exactly. The problem is that JWT's are awesome because they're stateless, but if you're using it as a session and you have to handle all those security vulnerabilities - it starts to be stateful and loses its main benefit.

Anyways, awesome article! :)

Roman Voloboev • Jan 10 '20 • Edited

Nice article, thanks!

It is good to combine User not found and Incorrect password to something like User not found or incorrect password for better security.

Brute-force protection is a must-have! You can read more here

Md Abu Taher • May 31 '19

Thank you for sharing such in-depth post.

Sam • May 31 '19

Thank you! Hope you liked it :)

Deepak Kumar • Dec 29 '19

Hi Sam,

I loved your post and an in-depth explanation of JWT.

I also wrote a similar post on Authentication in Nodejs. Feel Free to check it out :

Authentication in NodeJS With Express and Mongo - CodeLab #1

I would really like to know your feedback!

Tremaine Buchanan • Jun 14 '19

Thanks for the post. Gonna be implementing the user impersonation going forward for the apps that I build. The principle should suffice for a dotnet or JS backend.

Tomer • May 31 '19

Great article! But what are the params in .get(...) ? I only know it is path and cb.

How from isAuth you go to the next middleware ? Thanks

Sam • Jun 2 '19

The parameters in between the path and the callback/controller are the Middlewares.

Those are functions that are executed before the route callback, and have access to req and res objects of express.
Middlewares can be used for anything you want, a few examples: check user roles, API Input validation, log specific information, add timestamps of last user's activity, etc.

Here is more information.
expressjs.com/en/guide/using-middl...