JWT Authentication for REST API

Question

Here is my code to implement authentication in a Node/Express/Sequelize project. This is my first time using JWT and I would appreciate any help!

// Load required packages const jwt = require('jsonwebtoken'); const expressJwt = require('express-jwt'); const config = require('../config'); const User = require('../models').User; exports.authenticate = function(req, res) { const username = req.body.username; const password = req.body.password; User.findOne({ where: { username: username } }).then((user) => { // Make sure the password is correct if (user.verifyPassword(password)) { const token = jwt.sign({ username: user.username }, config.jwtSecret); res.json({ success: true, token: token, username: user.username }); } }).catch((error) => { console.error(error); res.sendStatus(404); }); } exports.isAuthenticated = expressJwt({ secret: config.jwtSecret }); 

Answer 1

Though not in Javascript, my uses of JWT have always used the password as the JWT secret. The JWT payload is whatever you need to identify the user -- username in your case. You can add in a CSRF token of some sort as well. I have an example on my GitHub that is a very simple application using JWT as the authentication mechanism - https://github.com/dave-shawley/readings/blob/7d2504587daa6a174fc3cbc0a5478fa817412eea/readings/static/js/login.js#L10-L26 is the javascript login code. Mind you that I am most certainly not a javascript programmer so don't read too much into my example for style advice ;)

My login code builds a JWT payload that looks something like:

{ "exp": 1488027170, "iss": "https://whatever.example.com/login", "csrf": "123456ABCDEF", "nbf": 1488026870 } 

where "nbf" is the current time, "exp" is the expiration time, and "iss" is the referring web site. "csrf" is a one-time token that is embedded in the HTML form.

I encode this structure using the entered password as the secret and pass the resulting token to my login endpoint. I have the user name in a secured cookie but it could be passed in the JWT payload as well. On the receiving side, I look up the user information in my data store by the user name from the cookie. Then I verify that the JWT payload was signed using the password as the secret and that it is still valid. If everything checks out, then the user is authenticated.

Answer 2

I can't be of much help with JWT, however if you are able to use es7 features, I would recommend utilising them.

const jwt = require('jsonwebtoken'); const expressJwt = require('express-jwt'); const config = require('../config'); const { User } = require('../models'); exports.authenticate = async (req, res) => { const { username, password } = req.body; try { const user = await User.findOne({ username }); if(!user.verifyPassword(password)) { //.. should send some sort of response here return; } const token = jwt.sign({ username: user.username }, config.jwtSecret); res.json({ success: true, token: token, username: user.username }); } catch (error) { console.error(error); res.sendStatus(404); } } exports.isAuthenticated = expressJwt({ secret: config.jwtSecret });