Web apps need to be authenticated to ensure that only the required people get access to the required data. Without strong authentication, you can suffer problems ranging from unauthorized login to complete leak of the database.
Authentication strategies are methods for user authentication and management. There are multiple ways to achieve this. With a constantly shifting landscape, it is difficult to zero in on one strategy as the best. Yet, it is a necessary element of almost all real world Node.js projects.
The authentication strategies in Node.js can broadly be classified into 3 types:
- Middleware Modules (like Passport.js)
- User Management as a Service
- Custom Database and Authentication
Middleware Modules
These are npm packages such as Passport.js, Everyauth and Permit. These are packages that work on top of Node.js frameworks such as Express.js, Koa.js, Hapify.js. They utilise the ‘connect’ middleware conventions. This means that while using the aforementioned frameworks, you can just plug in the modules and use their functionality.
These mainly deal with session management, and also provide single sign on features. But their functionality is largely limited to this. They do not provide other features like account verification and password reset, which are left to the developer to develop.
Passport.js is by far the most popular amongst these packages. It is an authentication middleware designed primarily to authenticate requests and to safeguard endpoints/routes from unknown users. It can be implemented within an Express-based Node.js web application.
Today, there are multiple ways of providing authentication: like a simple sign up/login or single-sign-on using an OAuth provider such as Facebook or Github, etc.. Passport offers a varied set of such mechanisms in the form of different packages, so that the developer doesn’t have to be burdened with extra dependencies.
app.post('/login', passport.authenticate('local', { successRedirect: '/',
failureRedirect: '/login' }));
As you can see in this route, passport.authenticate() is a middleware in the Express app route. In the passport authentication, ‘local’ option is opted which means using a custom username and password instead of OAuth through Facebook, Twitter or any other such provider. If the authentication is successful, then the user is redirected to the route ‘/’ and if it fails then the user is redirected to ‘/login’.
User Management as a Service
These are services such as Stormpath/Okta, Keycloak and Auth0. Over time, software has moved from on-premise to the cloud, to now a distributed API service. These technologies provide Identity Management APIs for software teams building web, mobile and API driven applications.
Identity management (ID management) is the organizational process for identifying, authenticating and authorizing individuals or groups of people to have access to applications, systems or networks by associating user rights and restrictions with established identities.
Such pre-built authentication and user management cut down cost & security risk of developing and maintaining identity in house. As a result, developers can focus on the core features instead. Compared to middleware modules, these provide more features than just securing endpoints. This includes email account verification, password reset workflows, role-based access, two-factor authentication and so on.
But introducing 3rd party services always has the requirement to be highly available, fast, portable, provide security during transport and most importantly provide flexibility based on the user model. These conditions vary vastly from service to service and an in-depth study needs to be done of all these before adopting a service.
Stormpath is one such service that offers identity management APIs. It is a cloud-based user data storage system with an option for private deployment. Features include user registration, authentication, authorization, user profiles, single-sign-on, multi-tenancy, token authentication, and API key management. It has an open source SDK present for most popular languages like Node.js, Angular.js, Java, PHP, Python, Ruby, .NET, iOS, Android.
Stormpath also supports easy integration with Passport.js.
var spClient = new stormpath.Client({ apiKey: apiKey });
// Grab our app, then attempt to create this user's account.
spClient.getApplication(process.env['STORMPATH_APP_HREF'], function(err, app) {
if (err) throw err;
app.createAccount({
givenName: 'John',
surname: 'Smith',
username: username,
email: username,
password: password,
}, function (err, createdAccount) {
if (err) {
return res.render('register', { title: 'Register', error: err.userMessage });
}
passport.authenticate('stormpath')(req, res, function () {
return res.redirect('/dashboard');
});
});
});
});
This showcases a part of how working with Stormpath would be for a developer. Here the createAccount() feature of Stormpath is being showcased. As you can see that Passport.js is also being used and the ‘stormpath’ strategy is chosen.
Custom Database and Authentication
This is the more do-it-yourself approach, where the developer builds the whole authentication architecture from scratch. It first starts with choosing your tech stack, database, hashing algorithm, method of maintaining sessions and so on. After this, the next part would be to build the user management service.
It is a common task as it is intrinsic to almost any real world project. But it is prone to error - as anything built from scratch suffers from. Moreover, there is a hefty amount of code to be maintained too. But this strategy provides the most amount of flexibility and freedom to the developer.
A traditional stack for achieving this would be to use a database like MongoDB or PostgresQL. Pick the required ORM like sequelize or mongoose with them. Bcrypt is a popular hashing algorithm which also has npm packages for its easy implementation.
After this, routes need to be created for account creation, user verification, login and password reset. Thereon, an authentication logic is written to secure the different endpoints, and even the database needs to be secured from unauthorized access using secret keys.
C. Data Structure/ Algorithm
