Here is more on why you should use bcrypt to hash passwords. Enter bcrypt.įrom Wikipedia: “bcrypt is a password hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher, and presented at USENIX in 1999”. Also, it would be a joke to use md5 for that and sha1 recently became unsafe.

In order to save the user in the database and later compare the password he/she enters for generating the authentication token, we need to encrypt his/her password, as it’s not safe to keep passwords with no encryption in the database. The token goes in the Authorization header of the HTTP method call, so the Passport middleware extracts and validates it. If we use Passport with a strategy for JWT, then it generates tokens that look for example like this:Į95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQĪ token contains its expiration date and can also contain data we need for checking the user. JWT (JSON Web Token) is an open, industry standard RFC 7519 method for representing claims securely between two parties. So Passport allows us to integrate login strategies for many kinds of services and they have currently more than 300 strategies that can be just plugged in, ready to be used. A comprehensive set of strategies support authentication using a username and password, Facebook, Twitter, and more”. Extremely flexible and modular, Passport can be unobtrusively dropped in to any Express-based web application. What is PassportĪs its website states: “Passport is an authentication middleware for Node.js.

In this post, all the code is in TypeScript and I expect you to have Node.js and MongoDB already configured on your OS. This post is based on the authentication implemented in the TODO List API project that you can find here. How to do that using Node.js?Ī combination of passport.js with JWT and bcrypt is one of the best ways to implement it. When you develop an API, most of the times you’ll need part or all of its endpoints to require authentication.

Node bcrypt