How to implement JWT Auth

[Rahulab14]

I'm Building Node.js application and want to add auth using using JWT.How to verify tokens in Express.

[balaji206]

You can implement JWT authentication in Express.js using the jsonwebtoken package.

Steps:

1. Install the package:
   npm install jsonwebtoken

2. Generate a token during login:
   const jwt = require('jsonwebtoken');

const token = jwt.sign({ userId: user._id }, 'secretKey', {
expiresIn: '1h'
});

3. Verify the token using middleware:
   const verifyToken = (req, res, next) => {
   const token = req.headers['authorization'];

if (!token) return res.status(403).send('Token required');

jwt.verify(token, 'secretKey', (err, decoded) => {
if (err) return res.status(401).send('Invalid token');
req.user = decoded;
next();
});
};

4. Use middleware in protected routes:
   app.get('/profile', verifyToken, (req, res) => {
   res.send('Protected data');
   });

This setup helps secure your API using JWT authentication.

[pradeep-chandragiri]

Implementation of JWT authentication using jsonwebtoken can be done in 2 ways:

1. Storing the JWT token in localStorage
2. Storing the token in cookies

It is recommended to use cookies to store the token, because the browser handles it automatically and it is more secure compared to localStorage — as JavaScript cannot access an httpOnly cookie, making it resistant to XSS attacks.

// Generate token
const token = jwt.sign(
{ userId: user.userId, email: user.email },
process.env.JWT_SECRET,
{ expiresIn: "3d" }
);

// Store in cookie
res.cookie('token', token, {
httpOnly: true,
sameSite: "strict",
secure: process.env.NODE_ENV === "production",
maxAge: 3 * 24 * 60 * 60 * 1000 // 3 days in milliseconds
});

// Verify token middleware
const verifyToken = (req, res, next) => {
// Get token from cookie
const { token } = req.cookies;

if (!token) return res.status(401).json({ message: "Unauthorized" });

// Decode and attach user
const decoded = jwt.verify(token, process.env.JWT_SECRET);
req.user = decoded;

next();
};

export default verifyToken;

// Protected route
router.get('/profile', verifyToken, getProfile);

This approach is more secure and reliable, as the browser automatically sends the cookie with every request — eliminating the need to manually pass the token in headers.