Authentication & Authorization

// Authentication: verifying identity
app.post('/login', async (req, res) => {
  const user = await verifyCredentials(req.body.username, req.body.password);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });
  req.session.userId = user.id;
});

// Authorization: checking permission for an already-authenticated user
app.delete('/posts/:id', requireAuth, (req, res) => {
  if (req.user.role !== 'admin') return res.status(403).json({ error: 'Forbidden' });
  deletePost(req.params.id);
});

Common follow-ups: What HTTP status codes are conventionally used to distinguish an authentication failure from an authorization failure?;How does session-based authentication differ architecturally from token-based authentication?

const session = require('express-session');
const RedisStore = require('connect-redis').default;

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  cookie: { secure: true, httpOnly: true, maxAge: 86400000 },
}));

app.post('/login', (req, res) => {
  req.session.userId = user.id; // stored server-side, keyed by the session ID cookie
  res.json({ success: true });
});

Common follow-ups: Why is httpOnly on the session cookie an important security setting?;What specifically breaks about in-memory session storage the moment an app is scaled to multiple processes or servers?

const jwt = require('jsonwebtoken');

const token = jwt.sign({ userId: user.id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' });

// Verifying an incoming token
try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET);
  req.user = decoded;
} catch (err) {
  return res.status(401).json({ error: 'Invalid or expired token' });
}

Common follow-ups: Why is it critical to never store sensitive data like a password inside a JWT's payload, given the payload is only encoded, not encrypted?;How do you handle revoking a JWT before its natural expiration, given it's normally self-contained and stateless?

app.post('/refresh', async (req, res) => {
  const oldRefreshToken = req.cookies.refreshToken;
  const stored = await refreshTokenStore.find(oldRefreshToken);
  if (!stored || stored.used) {
    await refreshTokenStore.revokeFamily(stored?.familyId); // detected reuse: revoke everything
    return res.status(401).json({ error: 'Token reuse detected' });
  }
  await refreshTokenStore.markUsed(oldRefreshToken);
  const newAccessToken = jwt.sign({ userId: stored.userId }, JWT_SECRET, { expiresIn: '15m' });
  const newRefreshToken = await refreshTokenStore.create(stored.userId, stored.familyId);
  res.cookie('refreshToken', newRefreshToken, { httpOnly: true, secure: true }).json({ accessToken: newAccessToken });
});

Common follow-ups: Where should the refresh token be stored on the client to minimize XSS exposure risk?;What's the tradeoff of shorter versus longer access token lifetimes in this scheme?

// Step 2: exchanging the authorization code for tokens (server-to-server)
const response = await fetch('https://oauth-provider.com/token', {
  method: 'POST',
  body: new URLSearchParams({
    grant_type: 'authorization_code',
    code: req.query.code,
    redirect_uri: REDIRECT_URI,
    client_id: CLIENT_ID,
    client_secret: CLIENT_SECRET, // kept only on the server, never sent to the browser
  }),
});
const { access_token } = await response.json();

Common follow-ups: Why is the Authorization Code flow considered more secure than the older Implicit flow for a server-side application?;What is PKCE, and why is it now recommended even for confidential clients?

const passport = require('passport');
const LocalStrategy = require('passport-local').Strategy;

passport.use(new LocalStrategy(async (username, password, done) => {
  const user = await User.findOne({ username });
  if (!user || !(await user.comparePassword(password))) return done(null, false);
  return done(null, user);
}));

app.post('/login', passport.authenticate('local'), (req, res) => res.json({ success: true }));

Common follow-ups: How does Passport's session serialization (serializeUser/deserializeUser) work to keep the session payload small?;What's a scenario where implementing authentication manually might be preferable to depending on Passport?

const bcrypt = require('bcrypt');

// Hashing during registration
const hashedPassword = await bcrypt.hash(plainTextPassword, 12); // 12 = cost factor
await User.create({ username, password: hashedPassword });

// Verifying during login
const isMatch = await bcrypt.compare(submittedPassword, user.password);

Common follow-ups: What is a 'cost factor' in bcrypt, and how do you choose an appropriate value that balances security and login-request latency?;Why is a per-password random salt important even when using a strong hashing algorithm?

function requireRole(...allowedRoles) {
  return (req, res, next) => {
    if (!allowedRoles.includes(req.user.role)) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    next();
  };
}

app.delete('/users/:id', requireAuth, requireRole('admin'), deleteUserHandler);
app.put('/posts/:id', requireAuth, requireRole('admin', 'editor'), updatePostHandler);

Common follow-ups: How does RBAC compare to a more granular permission-based (or ABAC, Attribute-Based Access Control) system when roles alone aren't expressive enough?;How would you handle a user who needs temporary elevated access for a specific task?

const speakeasy = require('speakeasy');

// Generating a secret during MFA setup
const secret = speakeasy.generateSecret({ name: 'MyApp' });
await User.update(userId, { totpSecret: secret.base32 });

// Verifying a code at login
const isValid = speakeasy.totp.verify({
  secret: user.totpSecret,
  encoding: 'base32',
  token: req.body.code,
  window: 1, // allows for slight clock drift
});

Common follow-ups: How should the TOTP secret itself be protected in the database, given it's effectively as sensitive as a password?;What backup mechanism should be provided for users who lose access to their authenticator device?

app.use(cookieParser());
const csrfProtection = csrf({ cookie: true });

app.get('/form', csrfProtection, (req, res) => {
  res.render('form', { csrfToken: req.csrfToken() });
});

app.post('/transfer', csrfProtection, (req, res) => {
  // request automatically rejected if the csrf token doesn't match
  processTransfer(req.body);
});

Common follow-ups: Why is CSRF primarily a concern for cookie/session-based authentication and largely irrelevant for token-based APIs that don't rely on cookies?;What's the difference between SameSite=Strict and SameSite=Lax in terms of what cross-site requests they actually block?