Secure Authentication API (Node.js & TypeScript) 🔐

Overview

This repository contains a robust, production-grade Authentication Backend built with Node.js, Express, and TypeScript.

The primary goal of this project is to demonstrate advanced backend security implementations, specifically focusing on Stateless Authentication (JWT), Secure Password Hashing (Bcrypt), and Cross-Site Scripting (XSS) Prevention through the use of HttpOnly Cookies.

🏗 Architecture (3-Tier Design)

The project strictly adheres to the 3-Tier Architecture Pattern for separation of concerns and maintainability:

1. Routes (/authRoutes): Handles HTTP endpoints and method routing.
2. Controllers (/authController): Manages HTTP request/response lifecycles, cookie injection, and status codes.
3. Services (/authServices): Contains the core business logic, database interactions, and cryptography.

🛡️ Security Features Implemented

• Strict Input Validation: Utilizes Zod (/zodSchema) to enforce rigorous schema validation at the router level, preventing SQL injection and malformed payloads before they reach the controller.
• Cryptographic Hashing: Passwords are never stored in plaintext. They are salted and hashed using Bcrypt with an appropriate cost factor.
• JWT (JSON Web Tokens): Stateless authentication mechanism used to verify user identity without querying the database on every request.
• HttpOnly Cookies: JWTs are not sent in the JSON response body. They are injected directly into strict HttpOnly and Secure cookies by the backend. This guarantees that malicious frontend JavaScript cannot access the tokens, completely neutralizing XSS token-theft attacks.
• Middleware Protection: Custom authentication middleware (/middlewera) intercepts protected routes, verifies the JWT signature, and injects the user payload into the request object.

🛠 Tech Stack

• Runtime: Node.js
• Language: TypeScript
• Framework: Express.js
• Validation: Zod
• Security: Bcrypt, jsonwebtoken, cookie-parser
• Database: Supabase (PostgreSQL)

🚀 How it Works

1. Registration: User provides credentials -> Zod validates -> Bcrypt hashes password -> Stored in PostgreSQL.
2. Login: Credentials verified against hash -> JWT signed with secret -> Token attached to Response Header as an HttpOnly cookie.
3. Protected Routes: Client makes request -> Browser automatically attaches cookie -> Middleware verifies JWT -> Access granted/denied.