Building a Secure Login System with Node.js and Express: A Step-by-Step Guide

Introduction

In today’s digital age, ensuring the security of user information is paramount. One crucial aspect of any web application is implementing a secure login system. By using Node.js and Express, you can create a robust and reliable login system that safeguards user data. This step-by-step guide will walk you through the process, enabling you to enhance the security of your web applications.

Before we begin, let’s briefly discuss the tools we’ll be using:

• Node.js: A powerful JavaScript runtime environment that allows us to run JavaScript on the server-side.
• Express: A popular and minimalist web application framework for Node.js that simplifies routing, middleware, and other web development tasks.
• MongoDB: A document-oriented database that provides flexibility and scalability for storing user information securely.

Now, let’s dive into the step-by-step process of building a secure login system with Node.js and Express:

Step 1: Setting Up the Project

Start by creating a new directory for your project and initialize a new Node.js application. Open your terminal and run the following commands:

mkdir secure-login-system
cd secure-login-system
npm init -y

Step 2: Installing Dependencies

To create a secure login system, we need to install several dependencies. Run the following commands to install the required packages:

npm install express bcrypt jsonwebtoken mongoose express-validator dotenv

Step 3: Setting Up the Server

Create a new file named server.js in the project’s root directory and set up a basic Express server. Add the following code to server.js:

const express = require('express');
const app = express();

app.use(express.json());
app.use(express.urlencoded({ extended: false }));

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server is running on port ${PORT}`);
});

Step 4: Configuring the Database

In this step, we’ll set up the connection to our MongoDB database. Create a new file named db.js in the project’s root directory and add the following code:

const mongoose = require('mongoose');
require('dotenv').config();

const connectDB = async () => {
  try {
    await mongoose.connect(process.env.MONGO_URI, {
      useNewUrlParser: true,
      useUnifiedTopology: true,
    });
    console.log('MongoDB connected');
  } catch (err) {
    console.error(err.message);
    process.exit(1);
  }
};

module.exports = connectDB;

Step 5: User Model and Registration

We’ll now create a user model using Mongoose and implement the user registration functionality. In the project’s root directory, create a new folder named models and add a file named User.js. Add the following code to define the user model:

const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  name: {
    type: String,
    required: true,
  },
  email: {
    type: String,
    required: true,
    unique: true,
  },
  password: {
    type: String,
    required: true,
  },
  createdAt: {
    type: Date,
    default: Date.now,
  },
});

module.exports = mongoose.model('User', userSchema);

To handle user registration, create a new file named `auth.js

` in the project’s root directory. Add the following code:

const express = require('express');
const router = express.Router();
const bcrypt = require('bcrypt');
const { check, validationResult } = require('express-validator');
const jwt = require('jsonwebtoken');
const User = require('../models/User');
const auth = require('../middleware/auth');

// Register a new user
router.post(
  '/register',
  [
    check('name', 'Name is required').not().isEmpty(),
    check('email', 'Please include a valid email').isEmail(),
    check(
      'password',
      'Please enter a password with 6 or more characters'
    ).isLength({ min: 6 }),
  ],
  async (req, res) => {
    // Validate input
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }

    // Extract user data from request body
    const { name, email, password } = req.body;

    try {
      // Check if user already exists
      let user = await User.findOne({ email });
      if (user) {
        return res.status(400).json({ msg: 'User already exists' });
      }

      // Create new user instance
      user = new User({
        name,
        email,
        password,
      });

      // Encrypt the password
      const salt = await bcrypt.genSalt(10);
      user.password = await bcrypt.hash(password, salt);

      // Save the user to the database
      await user.save();

      // Create and return JSON Web Token (JWT)
      const payload = {
        user: {
          id: user.id,
        },
      };

      jwt.sign(
        payload,
        process.env.JWT_SECRET,
        { expiresIn: 3600 },
        (err, token) => {
          if (err) throw err;
          res.json({ token });
        }
      );
    } catch (err) {
      console.error(err.message);
      res.status(500).send('Server error');
    }
  }
);

module.exports = router;

Step 6: User Login

Next, let’s implement the user login functionality. In the auth.js file, add the following code to handle user login:

// User login
router.post(
  '/login',
  [
    check('email', 'Please include a valid email').isEmail(),
    check('password', 'Password is required').exists(),
  ],
  async (req, res) => {
    // Validate input
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }

    // Extract user data from request body
    const { email, password } = req.body;

    try {
      // Check if user exists
      let user = await User.findOne({ email });
      if (!user) {
        return res.status(400).json({ msg: 'Invalid credentials' });
      }

      // Validate password
      const isMatch = await bcrypt.compare(password, user.password);
      if (!isMatch) {
        return res.status(400).json({ msg: 'Invalid credentials' });
      }

      // Create and return JSON Web Token (JWT)
      const payload = {
        user: {
          id: user.id,
        },
      };

      jwt.sign(
        payload,
        process.env.JWT_SECRET,
        { expiresIn: 3600 },
        (err, token) => {
          if (err) throw err;
          res.json({ token });
        }
      );
    } catch (err) {
      console.error(err.message);
      res.status(500).send('

Server error');
    }
  }
);

Step 7: Protecting Routes

To protect certain routes and ensure that only authenticated users can access them, we’ll create a middleware function. In the middleware folder, create a new file named auth.js and add the following code:

const jwt = require('jsonwebtoken');
require('dotenv').config();

module.exports = function (req, res, next) {
  // Get the token from the request header
  const token = req.header('x-auth-token');

  // Check if no token is found
  if (!token) {
    return res.status(401).json({ msg: 'No token, authorization denied' });
  }

  try {
    // Verify the token
    const decoded = jwt.verify(token, process.env.JWT_SECRET);

    // Set the user in the request object
    req.user = decoded.user;

    // Proceed to the next middleware or route
    next();
  } catch (err) {
    res.status(401).json({ msg: 'Token is not valid' });
  }
};

Step 8: Conclusion

Congratulations! You have successfully built a secure login system using Node.js and Express. By following this step-by-step guide, you have learned how to set up the project, configure the server, connect to a database, create a user model, handle user registration and login, and protect routes using authentication middleware. Remember to store sensitive information securely and continuously update your security measures to stay ahead of potential threats.

By implementing a secure login system, you have taken a crucial step in safeguarding user data and ensuring the trust and confidence of your application’s users.

FAQs