JWT is a secure token format for authentication, consisting of header, payload, and signature; 2. Set up Node.js with Express, jsonwebtoken, bcryptjs, body-parser, and dotenv; 3. Create a server with user registration, password hashing, and login to generate JWT; 4. Implement token verification middleware to protect routes; 5. Store secrets in environment variables and use HTTPS in production; 6. Test registration, login, and access to protected routes using tools like curl or Postman; 7. Optionally implement refresh tokens for improved security and user experience; the system securely handles authentication using JWT in Node.js with Express and is ready for production when combined with a real database and proper security practices.

Adding authentication to a Node.js app using JSON Web Tokens (JWT) is a common and effective way to secure your APIs. Here's a practical guide to help you implement JWT-based authentication in a Node.js application using Express.

1. What is JWT?

JWT (JSON Web Token) is a compact, URL-safe token format used to securely transmit information between parties as a JSON object. It’s commonly used for authentication and authorization. A JWT typically consists of three parts: header, payload, and signature, separated by dots (e.g., xxx.yyy.zzz).

Once a user logs in, the server generates a JWT and sends it to the client. The client then includes this token in subsequent requests (usually in the Authorization header), and the server verifies it before granting access.

2. Setup and Dependencies

Start by initializing your Node.js project and installing required packages:

npm init -y
npm install express jsonwebtoken bcryptjs body-parser dotenv
npm install --save-dev nodemon

• express: Web framework
• jsonwebtoken: To generate and verify JWTs
• bcryptjs: To hash passwords
• body-parser: To parse incoming request bodies
• dotenv: To manage environment variables

Add a script to package.json for development:

"scripts": {
  "start": "node server.js",
  "dev": "nodemon server.js"
}

3. Basic Server Setup

Create a server.js file:

const express = require('express');
const bodyParser = require('body-parser');
const dotenv = require('dotenv');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcryptjs');

dotenv.config();

const app = express();
app.use(bodyParser.json());

// Simulated user database (use a real DB like MongoDB or PostgreSQL in production)
const users = [];

const SECRET_KEY = process.env.SECRET_KEY || 'your-super-secret-jwt-key';

// Utility: Generate JWT
const generateToken = (user) => {
  return jwt.sign({ id: user.id, username: user.username }, SECRET_KEY, {
    expiresIn: '1h',
  });
};

// Middleware: Authenticate token
const authenticateToken = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN

  if (!token) {
    return res.status(401).json({ message: 'Access denied. No token provided.' });
  }

  jwt.verify(token, SECRET_KEY, (err, user) => {
    if (err) {
      return res.status(403).json({ message: 'Invalid or expired token.' });
    }
    req.user = user;
    next();
  });
};

4. User Registration

app.post('/register', async (req, res) => {
  const { username, password } = req.body;

  if (!username || !password) {
    return res.status(400).json({ message: 'Username and password are required.' });
  }

  // Check if user already exists
  const existingUser = users.find(u => u.username === username);
  if (existingUser) {
    return res.status(400).json({ message: 'Username already exists.' });
  }

  // Hash password
  const hashedPassword = await bcrypt.hash(password, 10);

  const user = { id: users.length   1, username, password: hashedPassword };
  users.push(user);

  res.status(201).json({ message: 'User registered successfully.' });
});

5. User Login and Token Generation

app.post('/login', async (req, res) => {
  const { username, password } = req.body;

  const user = users.find(u => u.username === username);
  if (!user) {
    return res.status(400).json({ message: 'Invalid credentials.' });
  }

  const isPasswordValid = await bcrypt.compare(password, user.password);
  if (!isPasswordValid) {
    return res.status(400).json({ message: 'Invalid credentials.' });
  }

  const token = generateToken(user);
  res.json({
    message: 'Login successful.',
    token,
  });
});

6. Protected Route Example

app.get('/profile', authenticateToken, (req, res) => {
  res.json({ message: `Welcome ${req.user.username}`, userId: req.user.id });
});

7. Environment Variables

Create a .env file:

SECRET_KEY=change-this-to-a-very-long-random-string-in-production

This keeps your secret key secure and outside your codebase.

8. Testing the API

You can test using curl or tools like Postman:

Register:

curl -X POST http://localhost:3000/register \
  -H "Content-Type: application/json" \
  -d '{"username":"alice", "password":"secret123"}'

Login:

curl -X POST http://localhost:3000/login \
  -H "Content-Type: application/json" \
  -d '{"username":"alice", "password":"secret123"}'

Access protected route:

curl -X GET http://localhost:3000/profile \
  -H "Authorization: Bearer <your-jwt-token>"

Important Security Notes

• ? Always use HTTPS in production.
• ? Store the JWT secret in environment variables — never hardcode it.
• ? Set a reasonable token expiration (e.g., 15–60 minutes). Use refresh tokens for long-lived sessions.
• ? Validate and sanitize all inputs to prevent injection attacks.
• ?? In production, use a real database with proper indexing and security.

Optional: Refresh Tokens

For better UX, implement refresh tokens to renew access tokens without requiring re-login. This adds complexity but improves security and usability.

That’s it! You now have a working JWT authentication system in Node.js. It’s minimal but covers the essentials: registration, login, token generation, verification, and protected routes.

Basically just glue the pieces together securely — and never skip hashing passwords.

The above is the detailed content of Implementing Authentication with JWT in a Node.js App. For more information, please follow other related articles on the PHP Chinese website!