Authentication in NodeJS

http://www.passportjs.org is what I use.

External service: Authress, handles the mess that comes with authorization tokens, CORS, multiple sign-ins, session management. Also handles access control and permissions management which we couldn't find anywhere else.

One thing that's important to call out is that things like passport created a single point of failure within our architecture and wasn't ready to scale up like we needed.

I used to roll my own auth layer. Bad idea. Now I am always use firebase and I've been a happy camper ever since!

Hasura Backend Plus

I'm always integrating 3rd party auth, if I'm not using Django. Firebase or Auth0 are really great solutions. I really can't recommend them enough.

I used jsonwebtoken package in NodeJs and stored them in Redis.

I've thought about rolling out my own but then stopped when I consider how much work it is. Going a little bit beyond the standard auth mechanic i.e. managing access tokens, encrypting passwords, implementing basic CORS. You also need to implement password reset flows, send out email verification links etc. Login and registration screens need validation, you need to check and handle errors coming back from the server (e.g. duplicate email addresses, malformed email addresses). Enforce good password structure and prevent against brute force attacks.

And that's just to get you up and running, on top of that you probably want analytics e.g. to track logins, and be able to offer multiple sign-in methods e.g. Google.

Doing all this from scratch and doing it without leaving any holes is pretty gnarly, and is another thing to maintain and take you away from developing core app logic.

I've used Auth0 in the past which was pretty straight forward, but if you want to go down the self-hosted route, KeyCloak is an excellent open source oAuth server and it does the job pretty well (gives you everything I mentioned above out the box). On top of a browser client, it also has Node-Connect which gives you authentication middleware so you can call authenticate() on any route. I like having my auth logic totally separate to my app, feels more self-contained that way. It takes a while to set up and there's a bit of a learning curve but once that's done you can set and forget, it just works. I hear Firebase is good too.

I use session auth with Passport.js

Here's the collection of libraries I use for auth:

• express-session — store session data in cookies and database
• bcrypt — hash passwords
• jsonwebtoken — issue tokens for password resets

Authentication is pretty easy to solve, even when you add in OAuth providers like Google, Twitter, Facebook, etc, so Ive rolled my own. The flow is basically:

• User provides credentials (email/password or OAuth)
• Do credentials match a user in the database?
• If yes, create a row in the session table and issue a JWT with the created session ID
• Express middleware then expects said JWT on specified routes, validates its signature and that the session ID is valid

Authorization on the other hand, is a bit more difficult and will depend on the requirements of your app. Building and modeling ACLs (access control lists) for things can get a bit hairy at times, but Ive always tended to roll my own.