How to handle user sessions in a Node and React app?

Because there are already some specific solutions on here, I just want to make sure you are familiar with how this works at a high level.

There are two main ways to do this (not counting Facebook/.. login):

Method A:

1. Your react app login component sends a username and password to your server
2. the server checks it against database & on success returns generates a cryptograpically secure token
3. the server stores that token with the user_id in the database
4. the server returns the token to the client (react app), often as a cookie (set_cookie on the server)
5. the next time the react app makes a request to the server, it'll contain the cookie (make sure you're sending them)
6. when the server receives a request with a cookie, it looks up the session token in the table, checks if it's still valid (you can add expiration dates if you want) and returns the user id for the server to use
7. to determine in your react app if a user is logged in, you make an API request to the server (which will include the cookie if the user has it) and the server can then tell you if you are logged in based on the token validity.

Method B:
This is mostly like method A but the server doesn't store the secret token in a database and instead encrypts a message with a secret key and sends it to the client. When the client makes a request with the encrypted message, the server can decrypt it and check for it's contents (usually the userID and expiration date). JWT usually works like this

Method B has the advantage that it's decentralized and requires less database access, but the major downside that you can't invalidate sessions form the server.

If you have time, I'd recommend you familiarize yourself with method A, as it's the most flexible and you'll learn better what's really going on before you jump into existing solutions.

If you have any further questions about the "bigger picture" feel free to ask on twitter, I'm happy to help.

I'm a full stack dev working full time with js: node on the back and react on the front.

The way it's done is using JWT - JSON Web Tokens. You can use passport for the auth part, and then, use https://www.npmjs.com/package/jsonwebtoken to generate and verify the tokens. Let me know if you need more help.

Here's a 2-part article I used when I was first trying to figure out authentication with React. The only part I ignored is the JWT part. I use Redis to manage sessions instead of JWT.

https://vladimirponomarev.com/blog/authentication-in-react-apps-creating-components

I don't have a strong opinion about JWT. I just find managing sessions with cookies and Redis more straightforward, and I've never built an app that was so successful it became a choke point.

Check out AWS Cognito. It gets you really far down the field. It handles all user authentication, password reset, email validation, and the like. They will even build and host your account creation pages if you want.

Here's a quickie React.js + Cognito starter that I built.

Have a look at Facebook's excellent create-react-app, too. (If you follow back the repo I based my Cognito one on above, you will see that it ultimately uses FB's starter at core, too.)

This comment was deleted 9 years ago

This comment was deleted 9 years ago

This comment was deleted 7 years ago