Skip to content

Latest commit

 

History

History
109 lines (74 loc) · 3.56 KB

readme.md

File metadata and controls

109 lines (74 loc) · 3.56 KB
Raw

node-auth

Authentication boilerplate for Node.js.

Background

Originally inspired by Your Node.js authentication tutorial is (probably) wrong. Although its critique is on point, the article sadly doesn't offer any concrete solutions. This repo is my attempt to address those remarks in code. You can also find some of my research here.

Features

  • login, logout, and registration
  • email verification ("Confirm your email")
  • password reset ("Forgot password")
  • password confirmation ("Re-enter your password")
  • persistent login ("Remember me")
  • account lockout ("Too many failed login attempts")
  • rate limiting ("Too many requests")

Development

First, create a .env file:

cd api
cp .env.example .env

Next, populate APP_SECRET, which you can generate like so:

$ node
> require('crypto').randomBytes(32).toString('base64')

Make sure to also populate MAIL_* variables. For example, you can sign up for a free service like Mailtrap or Ethereal. Using Ethereal you can even create an account right from your terminal:

$ node
> require('nodemailer').createTestAccount().then(console.log)

Finally, boot the server:

npm run dev

Integration tests

Tip: just read the first test in each file to follow the happy path. Other tests cover non-standard scenarios.

npm test

API

Method URI Middleware
POST /register guest
POST /login
POST /logout auth
POST /email/verify
POST /email/resend
POST /password/email
POST /password/reset
POST /password/confirm auth

curl

Tip: run echo '-w "\n"' >> ~/.curlrc to auto-add a newline to response body.

# Auth

curl -d '{"email":"[email protected]","password":"test"}' -H 'Content-Type: application/json' \
  localhost:3000/login

curl -X POST \
  -b 'sid=s%3AT_Pkrw6AvSQ3LfOYC9q0EnE1uqWQhJbp.hTs%2BqXXHbFMn2dxgSKBWd%2F%2FEQ8xwnV3KKsA9IwVJ7nU' \
  localhost:3000/logout

curl -d '{"email":"[email protected]","password":"test","name":"Alex"}' \
  -H 'Content-Type: application/json' localhost:3000/register

# Email verification

curl -X POST \
  'localhost:3000/email/verify?id=2&expires=1626766452957&signature=ddd8e0451ef93172b5345e0f7d1e8a5e85b69bca2b2aeed80a14848d0d2fb2df'

curl -d '{"email":"[email protected]"}' -H 'Content-Type: application/json' localhost:3000/email/resend

# Password recovery

curl -d '{"email":"[email protected]"}' -H 'Content-Type: application/json' localhost:3000/password/email

curl -d '{"password":"123456"}' -H 'Content-Type: application/json' \
  'localhost:3000/password/reset?id=2&token=78f3065ed0b350b1ee1ea80162c2e2f4908fb5bc9d42c22e08202d2e79a0d180a59a86bf9885a002'

# Password confirmation

curl -d '{"password":"test"}' \
  -b 'sid=s%3AT_Pkrw6AvSQ3LfOYC9q0EnE1uqWQhJbp.hTs%2BqXXHbFMn2dxgSKBWd%2F%2FEQ8xwnV3KKsA9IwVJ7nU' \
  localhost:3000/password/confirm

Disclaimer

I am not a security expert. There is only so much I know, so there are likely things I missed. If you see something that doesn't make sense, poses a vulnerability, or otherwise needs improvement, please feel free to open an issue or submit a PR. All contributions are welcome!