Part 2: Strong Authentication and Authorization in Express APIs

Ram Kumar

Ram Kumar

October 2, 2024•5 min read

Message
Part 2: Strong Authentication and Authorization in Express APIs

Welcome back to the second post in our series on Security Practices for Express APIs! In this series, we’re covering essential techniques to secure your Express APIs and protect them from common vulnerabilities and attacks. In our first blog, we discussed the importance of using HTTPS to encrypt your API traffic. In this post, we’ll explore two of the most critical components of API security: Authentication and Authorization.

Authentication and authorization form the foundation of a secure API. Without proper mechanisms in place, your API may be vulnerable to unauthorized access, data leaks, or abuse. Let’s dive into how to implement these practices effectively in an Express API.

Understanding Authentication and Authorization

  • Authentication: This is the process of verifying a user’s identity. When a client attempts to access your API, authentication ensures that the user is who they claim to be.
  • Authorization: Once a user is authenticated, authorization checks whether the user has permission to access the requested resources or perform certain actions.

Why Strong Authentication Matters

Weak authentication methods can lead to unauthorized access, account compromise, and data breaches. Common authentication techniques like simple API keys or basic authentication (username/password) are no longer considered secure enough for modern APIs. Instead, you should adopt more robust methods like JSON Web Tokens (JWT) or OAuth 2.0.

1. Implementing JWT Authentication

JWT (JSON Web Token) is a widely used method for stateless authentication in APIs. A JWT is a compact, self-contained token that includes information about the user and is signed using a secret key. Once a user is authenticated, the server generates a token that the client sends with every subsequent request. This makes authentication scalable and stateless because the server does not need to store user sessions.

How JWT Works:

Login: The user sends their credentials (e.g., username and password) to the API.

Token Issuance: If the credentials are valid, the API generates a JWT and returns it to the client.

Token Usage: The client includes the JWT in the Authorization header of every subsequent request.

Verification: The API verifies the JWT on each request to ensure it is valid and not expired.

Code Example for JWT Authentication in Express:

import express, { Request, Response, NextFunction } from 'express';
import jwt from 'jsonwebtoken';

const app = express();
app.use(express.json());

// Secret key for signing JWT
const JWT_SECRET = 'your_jwt_secret_key';

// Define interfaces for TypeScript
interface UserPayload {
    username: string;
}

interface AuthenticatedRequest extends Request {
    user?: UserPayload;
}

// Login route (authentication)
app.post('/login', (req: Request, res: Response) => {
    const { username, password } = req.body;

    // Replace this with real authentication logic
    if (username === 'user' && password === 'password') {
        const token = jwt.sign({ username }, JWT_SECRET, { expiresIn: '1h' });
        return res.json({ token });
    } else {
        return res.status(401).send('Invalid credentials');
    }
});

// Middleware to protect routes (authorization)
const verifyToken = (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
    const token = req.headers['authorization'];

    if (!token) {
        return res.status(403).send('Token is required');
    }

    jwt.verify(token, JWT_SECRET, (err, decoded) => {
        if (err) {
            return res.status(401).send('Invalid token');
        }
        req.user = decoded as UserPayload;  // Store decoded user info in the request object
        next();
    });
};

// Protected route
app.get('/protected', verifyToken, (req: AuthenticatedRequest, res: Response) => {
    res.send(`Hello ${req.user?.username}, you have access to this route!`);
});

app.listen(3000, () => {
    console.log('Server running on port 3000');
});

In this example:

  • The /login route authenticates users and returns a JWT.
  • The verifyToken middleware protects routes by checking if the token is valid.
  • The /protected route is only accessible to users with a valid token.

Benefits of Using JWT:

  • Stateless: The server does not need to store session data, making it scalable.
  • Portable: The token can be used across different services and microservices.
  • Secure: The token is signed, ensuring its integrity and authenticity.

2. OAuth 2.0 for Authorization

In more complex systems, especially those interacting with third-party applications, OAuth 2.0 is a widely used authorization framework. OAuth 2.0 allows users to grant limited access to their resources on one service (e.g., Google or GitHub) without exposing their credentials.

How OAuth 2.0 Works:

Client Application: The application (client) requests authorization from the user.

Authorization Server: The authorization server (e.g., Google, GitHub) authenticates the user and issues an authorization token.

Resource Server: The client uses the token to access protected resources on behalf of the user.

OAuth 2.0 is particularly useful when your API needs to allow access to resources hosted on other platforms or services. Below is an example of how to implement OAuth 2.0 using Google’s OAuth in an Express API.

Setting up OAuth 2.0 with Google in Express

We’ll use Passport.js for integrating Google OAuth into our Express API. Passport.js is a flexible authentication middleware for Node.js, with strategies for many services, including Google.

Step-by-Step Guide:

Step 1: Install Required Packages

npm install express passport express-session passport-google-oauth20

npm install --save-dev @types/express @types/express-session @types/passport @types/passport-google-oauth20

Step 2: Configure Passport for Google OAuth

import express, { Request, Response } from 'express';
import passport from 'passport';
import session from 'express-session';
import { Profile, Strategy as GoogleStrategy } from 'passport-google-oauth20';

const app = express();

// Replace with your own credentials from Google Developer Console
const GOOGLE_CLIENT_ID = 'your-google-client-id';
const GOOGLE_CLIENT_SECRET = 'your-google-client-secret';

// Configure Passport.js with Google OAuth strategy
passport.use(
    new GoogleStrategy(
        {
            clientID: GOOGLE_CLIENT_ID,
            clientSecret: GOOGLE_CLIENT_SECRET,
            callbackURL: 'http://localhost:3000/auth/google/callback',
        },
        (accessToken, refreshToken, profile: Profile, done) => {
            // In a real app, you would save the user info to your database here.
            return done(null, profile);
        }
    )
);

// Passport session setup (serialization/deserialization of user)
passport.serializeUser((user, done) => {
    done(null, user);
});

passport.deserializeUser((user, done) => {
    done(null, user as Express.User);
});

// Express session setup
app.use(
    session({
        secret: 'your-session-secret',
        resave: false,
        saveUninitialized: true,
    })
);

app.use(passport.initialize());
app.use(passport.session());

// Google OAuth routes
app.get(
    '/auth/google',
    passport.authenticate('google', { scope: ['profile', 'email'] })
);

app.get(
    '/auth/google/callback',
    passport.authenticate('google', { failureRedirect: '/' }),
    (req: Request, res: Response) => {
        // Successful authentication
        res.redirect('/protected');
    }
);

// Protected route
app.get('/protected', (req: Request, res: Response) => {
    if (!req.isAuthenticated()) {
        return res.status(401).send('You are not authenticated');
    }
    const user = req.user as Profile;
    res.send(`Hello, ${user.displayName}`);
});

app.get('/', (req: Request, res: Response) => {
    res.send('<h1>Welcome! <a href="/auth/google">Login with Google</a></h1>');
});

app.listen(3000, () => {
    console.log('Server is running on http://localhost:3000');
});

3. Role-Based Access Control (RBAC)

Authorization can be further strengthened by implementing Role-Based Access Control (RBAC). RBAC allows you to grant specific permissions to users based on their roles (e.g., admin, user, editor). This ensures that users can only access the resources and actions they are allowed to.

Example of Implementing RBAC in Express:

import express, { Request, Response, NextFunction } from 'express';
const app = express();

interface User {
    role: 'user' | 'admin';
}

interface AuthenticatedRequest extends Request {
    user: User;
}

const roles: Record<string, string[]> = {
    user: ['read'],
    admin: ['read', 'write', 'delete'],
};

// Middleware to check permissions
const checkRole = (role: string) => (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
    const userRole = req.user.role;
    if (roles[userRole].includes(role)) {
        next();
    } else {
        res.status(403).send('Access denied');
    }
};

// Middleware to verify token (mock example)
const verifyToken = (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
    // In real-world cases, you'd verify the JWT or session token here
    // Simulating a user being attached to the request
    req.user = { role: 'admin' }; // Assume user is admin for this example
    next();
};

// Protected route for admins only
app.post('/admin', verifyToken, checkRole('write'), (req: AuthenticatedRequest, res: Response) => {
    res.send('Admin route accessed');
});

app.listen(3000, () => {
    console.log('Server running on port 3000');
});

4. Implementing the Principle of Least Privilege

When setting up authorization, it’s important to follow the principle of least privilege. This principle states that users should have the minimum level of access necessary to perform their tasks. By limiting access, you reduce the potential damage that can be caused by compromised accounts or malicious actors.


Conclusion

Authentication and authorization are critical to securing your Express APIs. By implementing strong authentication mechanisms like JWT or OAuth 2.0, and combining them with robust authorization techniques such as Role-Based Access Control (RBAC), you can significantly reduce the risk of unauthorized access and ensure that only authorized users can interact with sensitive data or perform restricted actions.

Additionally, adhering to the principle of least privilege ensures that users are granted only the access they need to fulfill their roles, thereby minimizing potential security risks.

By applying these techniques, your API will be well-protected against unauthorized access and will operate securely within the proper limits of user permissions. This forms a strong foundation for the security of any API-driven application.

What's Next?

In the next post of this series, we will dive into Rate Limiting and Throttling—another crucial practice for safeguarding your API from abuse and preventing denial-of-service (DoS) attacks. Rate limiting ensures that your API can handle high traffic without being overwhelmed and keeps it safe from malicious actors trying to flood your service with excessive requests.

Stay tuned for Part 3, where we'll cover how to implement rate limiting and throttling in Express APIs to improve security and performance.

Previous: Part 1 : HTTPS Everywhere – A Must for Secure Express APIs
Next: Part 3:How to Implement Rate Limiting and Throttling in Express APIs with TypeScript
LinkedIn
X
youtube