JWT Authentication

A scalable JWT-based authentication system for Express with secure route protection, refresh tokens, and extendable user models.

authjwtexpresssecurityscalable

v3.0.0auth

Overview

A secure and modular JWT authentication system built for Express.js. Includes registration, login, logout, refresh tokens, and route protection. The structure follows modern best practices and supports integration with MongoDB, PostgreSQL, Prisma, or any ORM/ODM as needed. The User model and authentication logic can easily be customized or extended.

Installation

CLI

npx backternity add auth-jwt

What This Does

Installs a ready-to-use JWT authentication system with routes, middleware, and secure token management for Express apps.

Files & Folders Created

File / Path	Description
/src/routes/auth.js	Handles registration, login, refresh, logout.
/src/services/authService.js	Core logic for authentication and token handling.
/src/middleware/auth.js	Middleware for validating JWT tokens.
/src/models/user.js	Default user model (can be customized).
/src/models/tokenBlacklist.js	Optional refresh token blacklist model.
/src/utils/response.js	Standardized API response helper.

Files to be modified

File / Path	Description
server.js	Mounts /api/auth routes.
.env	Adds JWT configuration keys and expiration times.

Configuration

# Environment Variables
JWT_SECRET=your-super-secret-key
JWT_EXPIRES_IN=15m
REFRESH_EXPIRES_IN=30d
# Optional if using MongoDB
MONGODB_URI=mongodb://localhost:27017/backternity-app

Frontend Integration

Here’s an example of integrating the authentication routes with a Next.js frontend using React hooks and fetch API for login and protected route access.

POST/api/auth/register

Registers a new user and returns JWT tokens.

POST/api/auth/login

Authenticates user credentials and issues access/refresh tokens.

GET/api/auth/me

Retrieves authenticated user profile using JWT.

POST/api/auth/logout

Revokes refresh token and logs the user out securely.

POST/api/auth/refresh

Generates a new access token using a valid refresh token.

Example

// app/components/LoginForm.jsx
'use client';
import { useState } from 'react';

export default function LoginForm() {
  const [email, setEmail] = useState('');
  const [password, setPassword] = useState('');
  const [user, setUser] = useState(null);
  const [error, setError] = useState(null);

  async function handleLogin(e) {
    e.preventDefault();
    setError(null);

    try {
      const res = await fetch('/api/auth/login', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ email, password }),
      });

      const data = await res.json();

      if (!data.success) throw new Error(data.message);
      localStorage.setItem('accessToken', data.data.token);
      localStorage.setItem('refreshToken', data.data.refresh);

      const me = await fetch('/api/auth/me', {
        headers: {
          Authorization: 'Bearer ' + data.data.token,
        },
      });

      const userData = await me.json();
      setUser(userData);
    } catch (err) {
      setError(err.message);
    }
  }

  return (
    <div className="max-w-sm mx-auto bg-black/20 border border-white/10 rounded-xl p-6 text-white space-y-4">
      <h2 className="text-xl font-semibold">Login</h2>
      <form onSubmit={handleLogin} className="space-y-3">
        <input
          type="email"
          value={email}
          onChange={(e) => setEmail(e.target.value)}
          placeholder="Email"
          className="w-full px-3 py-2 rounded-md bg-white/10 border border-white/20 focus:outline-none"
          required
        />
        <input
          type="password"
          value={password}
          onChange={(e) => setPassword(e.target.value)}
          placeholder="Password"
          className="w-full px-3 py-2 rounded-md bg-white/10 border border-white/20 focus:outline-none"
          required
        />
        <button
          type="submit"
          className="w-full bg-emerald-500 hover:bg-emerald-600 text-white font-semibold py-2 rounded-md transition-colors"
        >
          Sign In
        </button>
      </form>

      {error && <p className="text-red-400 text-sm">{error}</p>}
      {user && (
        <div className="mt-4 p-3 bg-emerald-500/10 rounded-lg border border-emerald-500/20">
          <p className="text-sm text-emerald-300">Welcome, {user.email}</p>
        </div>
      )}
    </div>
  );
}

Usage

// Protecting routes in Express
const express = require('express');
const { validateAuth } = require('./src/middleware/auth');
const app = express();

app.get('/api/protected', validateAuth, (req, res) => {
  res.json({ message: 'Access granted', user: req.user });
});