JWT Authentication Middleware (Using HTTP-Only Cookies)
npm install jsonwebtoken cookie-parserconst express = require("express");
const cookieParser = require("cookie-parser");
const app = express();
app.use(express.json());
app.use(cookieParser());
app.use("/api", require("./routes"));
module.exports = app;PORT=5000
JWT_SECRET=your_super_secret_key_here
JWT_EXPIRES_IN=7d
NODE_ENV=developmentconst jwt = require("jsonwebtoken");
const token = jwt.sign(
{
userId: user._id,
email: user.email,
role: user.role
},
process.env.JWT_SECRET,
{
expiresIn: process.env.JWT_EXPIRES_IN
}
);res.cookie("token", token, {
httpOnly: true,
secure: process.env.NODE_ENV === "production",
sameSite: "strict",
maxAge: 7 * 24 * 60 * 60 * 1000
});
return res.status(200).json({
success: true,
message: "Login successful"
});const jwt = require("jsonwebtoken");
const authMiddleware = (req, res, next) => {
try {
const token = req.cookies.token;
if (!token) {
return res.status(401).json({
success: false,
message: "Authentication required."
});
}
const decoded = jwt.verify(
token,
process.env.JWT_SECRET
);
req.user = decoded;
next();
} catch (error) {
if (error.name === "TokenExpiredError") {
return res.status(401).json({
success: false,
message: "Session expired."
});
}
if (error.name === "JsonWebTokenError") {
return res.status(401).json({
success: false,
message: "Invalid authentication token."
});
}
return res.status(500).json({
success: false,
message: "Internal Server Error"
});
}
};
module.exports = authMiddleware;const express = require("express");
const authMiddleware = require("../middleware/auth.middleware");
const router = express.Router();
router.get("/profile", authMiddleware, (req, res) => {
res.status(200).json({
success: true,
user: req.user
});
});
module.exports = router;const logout = (req, res) => {
res.clearCookie("token", {
httpOnly: true,
secure: process.env.NODE_ENV === "production",
sameSite: "strict"
});
res.status(200).json({
success: true,
message: "Logged out successfully."
});
};
module.exports = logout;const jwt = require("jsonwebtoken");
const login = async (req, res) => {
const user = {
_id: "68783b4a25d9ab1",
email: "rohan@example.com",
role: "user"
};
const token = jwt.sign(
{
userId: user._id,
email: user.email,
role: user.role
},
process.env.JWT_SECRET,
{
expiresIn: process.env.JWT_EXPIRES_IN
}
);
res.cookie("token", token, {
httpOnly: true,
secure: process.env.NODE_ENV === "production",
sameSite: "strict",
maxAge: 7 * 24 * 60 * 60 * 1000
});
return res.status(200).json({
success: true,
message: "Login successful."
});
};
module.exports = login;router.get("/dashboard", authMiddleware, (req, res) => {
console.log(req.user.userId);
console.log(req.user.email);
console.log(req.user.role);
res.json({
success: true,
user: req.user
});
});project/
│
├── middleware/
│ └── auth.middleware.js
│
├── controllers/
│ ├── login.controller.js
│ └── logout.controller.js
│
├── routes/
│ └── index.js
│
├── app.js
├── server.js
└── .envJWT (JSON Web Token) is one of the most popular methods for authenticating users in modern web applications. Instead of storing session data on the server, JWT stores user information inside a signed token that can be...
Read Full Documentation →
