Express.js: Protecting Routes with JWT

Express.js is a popular and robust web application framework for Node.js. It simplifies the process of building web applications and APIs by providing a range of features and tools. One crucial aspect of web development is security, especially when dealing with routes that need to be protected from unauthorized access. JSON Web Tokens (JWT) have become a common way to secure routes in web applications. In this article, we’ll explore how to use JWT to protect routes in an Express.js application.

What is a JSON Web Token (JWT)?

A JSON Web Token, or JWT, is a compact and self-contained way to represent information between parties. It is often used for securely transmitting information between the client and the server. A JWT consists of three parts:

1. Header: Contains the type of the token and the signing algorithm being used.
2. Payload: Contains claims (statements) about an entity (typically, the user) and additional data.
3. Signature: To verify the sender of the JWT, it’s used to ensure the message wasn’t changed along the way.

JWTs are commonly used for authentication and authorization in web applications. They are often issued upon successful user authentication and contain information about the user’s identity and access permissions.

Setting up an Express.js Application

Before diving into JWT protection, let’s set up a basic Express.js application. You can create a new project and install Express using npm or yarn:

npm init -y
npm install express

Next, create a basic Express app in a JavaScript file (e.g., app.js):

const express = require('express');
const app = express();
const port = 3000;

app.get('/', (req, res) => {
  res.send('Hello, World!');
});

app.listen(port, () => {
  console.log(`Server is running on port ${port}`);
});

Now, you can start the application using node app.js. You should see “Hello, World!” displayed when you access http://localhost:3000 in your web browser.

Installing Required Dependencies

To work with JWT in your Express.js application, you’ll need some additional packages. You can install them using npm or yarn:

npm install jsonwebtoken express-validator body-parser

• jsonwebtoken is a popular package for creating and verifying JWTs.
• express-validator is a middleware that will help you validate incoming request data.
• body-parser is used to parse JSON and URL-encoded data from incoming requests.

Adding JWT Protection to Your Express Application

To protect routes using JWT in your Express application, you need to follow these steps:

1. Import required modules and set up middleware.

In your Express app (app.js), include the necessary modules and set up middleware to parse incoming JSON data and handle validation:

const express = require('express');
const app = express();
const port = 3000;
const bodyParser = require('body-parser');
const { body, validationResult } = require('express-validator');
const jwt = require('jsonwebtoken');

// Middleware
app.use(bodyParser.json());

2. Create a secret key for JWT.

You’ll need a secret key to sign and verify JWTs. It’s crucial to keep this key secure and not expose it in your code. You can store it in an environment variable or a configuration file.

const secretKey = 'your-secret-key'; // Replace with a strong, randomly generated secret key.

3. Create routes for user registration and login.

Set up routes for user registration and login. Here’s an example of how to create these routes:

// Mock user data (you should use a database in a real application).
const users = [];

app.post(
  '/register',
  body('username').notEmpty(),
  body('password').isLength({ min: 6 }),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }

    const { username, password } = req.body;
    users.push({ username, password });
    res.json({ message: 'User registered successfully' });
  }
);

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  const user = users.find((u) => u.username === username && u.password === password);

  if (user) {
    // Generate a JWT token upon successful login.
    const token = jwt.sign({ username }, secretKey);
    res.json({ token });
  } else {
    res.status(401).json({ error: 'Invalid credentials' });
  }
});

4. Protect routes with JWT.

You can protect specific routes by verifying the JWT token before processing the request. Here’s an example of protecting a route:

// Protected route
app.get('/protected', (req, res) => {
  const token = req.header('x-auth-token'); // Get the token from the request headers.

  if (!token) {
    return res.status(401).json({ error: 'Access denied. No token provided.' });
  }

  try {
    // Verify the token using the secret key.
    const decoded = jwt.verify(token, secretKey);
    res.json({ message: 'This is a protected route', user: decoded.username });
  } catch (error) {
    res.status(400).json({ error: 'Invalid token' });
  }
});

In this example, the x-auth-token header is used to send the JWT token with the request. The route checks for the presence of the token and verifies it using the secret key.

5. Start the server.

Finally, start your Express.js server as before:

app.listen(port, () => {
  console.log(`Server is running on port ${port}`);
});

Conclusion

Securing your Express.js routes with JSON Web Tokens is an effective way to protect your application’s resources. By implementing user registration, login, and route protection with JWT, you can ensure that only authenticated and authorized users can access specific parts of your application. Remember to keep your secret key secure, and consider using a database to store user data in a real-world application. With JWT and Express.js, you can build more secure and reliable web services and APIs.