Node.js security

Question

I am building a basic app using node.js and mysql and just getting a hang of it, I would like to secure the api,like only allow certain people to access the data, maybe by passing a certain token each time a user requests for some information, I tried searching for certain tutorials which used node.js and mysql database and security, I am confused as to which security measure to use, I even read about Json Web Tokens but din't find a proper tutorial for that.Please point me in the right direction.

EDIT

What I meant to say was, only authenticated users are allowed to get access to data in the api, when a random visitor tries to access a URL he shouldnt be alowed to without proper authentication,what I am mostly looking for now is when a user is authenticated the user should be a sent a token of some sort so then gets access to private data,I don't exactly know how to go about this whole thing.Would be glad if you could clear it up for me.

Answer 1

No sure what your exact question is about, but I think the below will help:

Node.js security tips: http://blog.risingstack.com/node-js-security-tips/

Secure Express apps with various HTTP headers: https://github.com/helmetjs/helmet

Go on an educational Web security adventure: https://github.com/toolness/security-adventure

Node.js Security presentation: http://www.slideshare.net/d0cent/nodejs-security?qid=c450507b-e491-4e9a-9b05-89d0c82ea10b&v=default&b=&from_search=6

Answer 2

I would look at implementing Oauth2 server in your app. I found this article useful:

http://blog.papersapp.com/oauth-server-in-node-js/

Answer 3

Take a look at http://passportjs.org/ . Passport has support for alot of authentication methods, however, for your API, you will probably want to use OAuth ( http://passportjs.org/docs/oauth2-api ). OAuth is what most popular APIs use to authenticate consumers.

For simple projects, You can also use basic authentication, which is what you see when you see the browser prompt asking for username and password. This authentication information can be sent in the header when API consumers makes requests.