Authentication Roadmap for Node.js: From Zero to Production

Authentication Roadmap for Node.js: From Zero to Production

A roadmap keeps your auth learning focused. Here is the path from zero to production-ready auth in Node.js.

Step 1: Understand Auth Fundamentals

Know the difference between authentication (who are you?) and authorization (what can you do?). Know the request-response cycle and how cookies work.

Step 2: Set Up the User Model

Define a User schema with email, passwordHash, role. Mark passwordHash with select: false. Add a unique index on email. Add timestamps.

Step 3: Implement Signup

Validate input with Zod. Check for duplicate email. Hash the password with bcrypt (10 rounds). Create the user. Return 201 with a serializer that omits passwordHash.

Step 4: Implement Login

Find user by email (with +passwordHash). Compare password with bcrypt.compare. If match, sign a JWT with jwt.sign({ userId }, secret, { expiresIn: '7d' }). Set the JWT in an httpOnly, secure, sameSite cookie. Return 200 with the user.

Step 5: Implement Logout

Clear the cookie. Return 200. If using refresh tokens, delete the refresh token from the DB.

Step 6: Write the Auth Middleware

Read the token from req.cookies.token or the Authorization header. Verify with jwt.verify(token, secret). Set req.user from the payload. Call next or return 401.

Step 7: Protect Routes

Apply the auth middleware to routes that need auth. Keep public routes outside. Use router.use(auth) for groups of routes.

Step 8: Add Role-Based Access Control

Add a role field on the user. Write a requireRole factory. Apply to admin routes. Check resource ownership for user-specific resources.

Step 9: Add Refresh Tokens

Issue a short-lived access token (15 min) and a long-lived refresh token (7 days, stored in DB). Add a /refresh endpoint that issues a new access token. Rotate refresh tokens for extra security.

Step 10: Implement Password Reset

Generate a random token, store its hash with a 15-min expiry, email a link with the raw token, verify on reset, hash the new password, invalidate the token. Rate limit the request endpoint.

Step 11: Add Security Middlewares

helmet, cors, express-rate-limit, express-mongo-sanitize, xss-clean, hpp. Treat security as a feature.

Step 12: Rate Limit Auth Routes

5 attempts per 15 minutes on login and signup. Prevents brute force.

Step 13: Use HTTPS

Never send credentials over HTTP. Use Let's Encrypt for free certs. Set secure: true on cookies.

Step 14: Invalidate Sessions on Password Change

Bump a tokenVersion field. The auth middleware checks it. After a change, old JWTs are rejected.

Step 15: Test Auth Flows

Use Jest and supertest. Test signup, login, logout, protected routes, role checks, password reset, and token refresh. Run tests in CI.

The Takeaway

The auth roadmap: understand fundamentals, set up the User model, implement signup and login with bcrypt and JWT, write the auth middleware, protect routes, add RBAC, add refresh tokens, implement password reset, add security middlewares, rate limit auth routes, use HTTPS, invalidate sessions on password change, and test auth flows.