使用令牌进行身份验证来标识后端和前端上的用户

Question

I would like to create a simple Express API using Json Web Tokens. When the user tries to sign in I execute this

exports.signIn = async (req, res, next) => {
    const { username, password } = req.body;

    // get user from database
    const userQueryResult = await userQueries.getUserByName([username]);

    // return if database errors occured
    if (userQueryResult.err) {
        res.status(500).json({
            message: userQueryResult.err.message
        });
    }

    const users = userQueryResult.result;
    const user = users[0];

    // no user found
    if (!user) {
        res.status(401).json({
            message: 'Auth failed'
        });
    }

    try {
        // validate the password
        const passwordMatch = bcrypt.compareSync(password, user.passwordHash);

        // wrong credentials
        if (!passwordMatch) {
            res.status(401).json({
                message: 'Auth failed'
            });
        }

        const token = jwt.sign({
            user.id
        }, tokenSecret, {
                tokenExpiration
            });

        res.status(200).json({
            message: 'Auth succeeded',
            token
        });
    } catch (err) {
        res.status(401).json({
            message: 'Auth failed'
        });
    }
};

A new token gets generated and is sent to the client. Do I have to send the user object to the client too? Because currently I'm only checking if a user is authenticated but not which one.

For protected routes I check if a user is authenticated by using a middleware function

module.exports = (req, res, next) => {
    try {
        const rawToken = req.headers.authorization; // bearer <token>
        const token = rawToken.split(' ')[1]; // extract the token
        req.userData = jwt.verify(token, tokenSecret); // verify this token
        next();
    } catch (error) {
        res.status(401).json({
            message: 'Auth failed'
        });
    }
}

So would you send the user id to the client too? Do you store it to the local browser storage with the token and delete it when removing the token?

Maybe I got it wrong but currently I only know how to check if someone is authenticated but not which one. The client needs to know which user is currently signed in.

Answer 1

A new token gets generated and is sent to the client. Do I have to send the user object to the client too? Because currently I'm only checking if a user is authenticated but not which one.

Technically you could send also user object (and any other info), but generally what you want to send back is only jwt token, since it has all the information (payload) inside that you need on your client side.

So would you send the user id to the client too?

Same as previous answer, if you need user id on the client side, you include it into jwt payload.

Do you store it to the local browser storage with the token and delete it when removing the token?

If you need it as something permanent (page reload) them yes, save jwt token or anything else for that matter into the local storage.

Maybe I got it wrong but currently I only know how to check if someone is authenticated but not which one. The client needs to know which user is currently signed in.

What you are looking for is user authorization (not authentication) which you check on the server side.

Answer 2

You got two options:

1) You could store the user in the JWT.

Through that you can easily access it on the backend when another request comes in (not on the frontend though, as JWTs are encrypted). This might be faster than looking up the user every time. However you'd have to send the user to the frontend and back again on every request done, which slows things down, also you copy the data, and if the database record changed you won't notice

2) Store a user or session id in the JWT, then look that up in a database / in memory Map to get the user. While the database gets used mkre with this, you save bandwith and keep track with changes.

// on login
const token = jwt.sign({ id: user.id }, tokenSecret, { tokenExpiration });
// or
const token = jwt.sign({ user }, tokenSecret, { tokenExpiration  });

To then be able to show the data of the user on the client, you have to send it in an unencrypted way, eg:

 res.send(`Your name is ${user.name} and you got the id ${user.id}`);

Answer 3

I try to answer your questions:

Do I have to send the user object to the client too?

it depends if you need user you can send it. I usually store user object in req.user by creating a middleware eg authMiddleware like this:

const { User } = require('../models/user');
let authenticate = function (req, res, next) {
    let token = req.cookies.access_token;
    User.findByToken(token).then((user) => {
        req.user = user;
        req.token = token;
        next();
    }).catch(e => {
        res.redirect('/');
    })
}
module.exports = {
    authenticate
}

i assume you use mongodb and mongoose. what is findByToken() method? it's custom mongoose model method:

// user model
const mongoose = require('mongoose');
let UserSchema = new mongoose.Schema({
   ...your model schema,
   tokens: [{  //here is tokens array
        access: {
            type: String,
            required: true
        },
        token: {
            type: String,
            required: true
        }
    }],
}
UserSchema.statics.findByToken = function (token) {
    let user = this;
    let decoded;
    try {
        decoded = jwt.verify(token, 'secret')
    } catch (e) {
        return Promise.reject();
    }
    return user.findOne({
        '_id': decoded._id,
        'tokens.access': 'auth',
        'tokens.token': token
    })
}

let User = mongoose.model('User', UserSchema);
module.exports = { User };

So would you send the user id to the client too? Do you store it to the local browser storage with the token and delete it when removing the token?

after singing a token you must store token in tokens Array of user model document

UserSchema.methods.generateAuthToken = function () {
    let user = this;
    let access = 'auth';
    let token = jwt.sign({ '_id': user._id.toHexString(), access }, 'secret').toString();
    user.tokens = user.tokens.concat([{ access, token }]);

    return user.save().then(() => {
        return token;
    })

}

it's recommended to store token in the cookie:

res.cookie('access_token', token, {
    maxAge: 3600000,
    httpOnly: true
})