JWT Authentication in Node.js

Learn how JSON Web Tokens work, how to generate and verify JWTs, and how to protect Express.js API routes using token-based authentication.

1. What Is JWT Authentication?

JWT authentication allows a server to issue a signed token after successfully verifying a user's credentials. The client can then send that token with later requests to access protected routes.

2. What Does a JWT Look Like?

A typical signed JWT contains three parts separated by dots:

header.payload.signature

3. Install the Required Packages

Create a Node.js project if you do not already have one:

mkdir node-jwt-app
cd node-jwt-app
npm init -y

Install Express, JWT support, password hashing, and environment configuration:

npm install express jsonwebtoken bcryptjs dotenv

Package Explanation

4. Create a JWT Secret

A secret key is used to sign and verify tokens when using a symmetric algorithm such as HS256.

Generate a strong random secret using Node.js:

node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

Create a .env file:

JWT_SECRET=replace_with_your_generated_random_secret
PORT=5000

Replace the placeholder with the generated value. Keep the .env file private and do not commit it to source control.

.env
node_modules/

5. Generate a JWT Token

The jwt.sign() method creates a signed token from a payload and signing key.

require("dotenv").config();

const jwt = require("jsonwebtoken");

if (!process.env.JWT_SECRET) {
    throw new Error("JWT_SECRET must be configured");
}

const token = jwt.sign(
    { userId: 101 },
    process.env.JWT_SECRET,
    {
        algorithm: "HS256",
        expiresIn: "1h"
    }
);

console.log(token);

Explanation

• jwt.sign() creates a signed JWT.
• userId identifies the user in this example.
• JWT_SECRET is the signing secret.
• algorithm: "HS256" explicitly selects the signing algorithm.
• expiresIn: "1h" makes the token expire after one hour.

6. Verify a JWT Token

Use jwt.verify() to check the token's signature, expiration, and other applicable registered claims.

require("dotenv").config();

const jwt = require("jsonwebtoken");

const token = jwt.sign(
    { userId: 101 },
    process.env.JWT_SECRET,
    {
        algorithm: "HS256",
        expiresIn: "1h"
    }
);

try {
    const decoded = jwt.verify(
        token,
        process.env.JWT_SECRET,
        {
            algorithms: ["HS256"]
        }
    );

    console.log(decoded);
} catch (error) {
    console.log("Invalid or expired token");
}

Example Decoded Payload

{
    userId: 101,
    iat: 1234567890,
    exp: 1234571490
}

The iat and exp values represent token issue and expiration times as Unix timestamps. The numbers above are illustrative.

7. Create a Practice User Store

For this beginner example, we will store one practice account in memory. A real application should use a database and enforce unique accounts at the database level.

Create users.js:

const bcrypt = require("bcryptjs");

const users = [
    {
        id: 1,
        name: "Rahul Kumar",
        email: "rahul@example.com",
        passwordHash: bcrypt.hashSync("ExamplePass123", 12)
    }
];

module.exports = users;

8. Create a Complete JWT Authentication API

Create a file named server.js. It includes a login route, JWT creation, authentication middleware, and a protected profile route.

require("dotenv").config();

const express = require("express");
const jwt = require("jsonwebtoken");
const bcrypt = require("bcryptjs");
const users = require("./users");

const app = express();

app.use(express.json());

if (!process.env.JWT_SECRET) {
    throw new Error("JWT_SECRET must be configured");
}

// Login route
app.post("/login", async (req, res) => {
    try {
        const { email, password } = req.body;

        if (
            typeof email !== "string" ||
            typeof password !== "string"
        ) {
            return res.status(400).json({
                message: "Email and password are required"
            });
        }

        const normalizedEmail = email.trim().toLowerCase();

        const user = users.find(
            item => item.email === normalizedEmail
        );

        if (!user) {
            return res.status(401).json({
                message: "Invalid email or password"
            });
        }

        const passwordMatches = await bcrypt.compare(
            password,
            user.passwordHash
        );

        if (!passwordMatches) {
            return res.status(401).json({
                message: "Invalid email or password"
            });
        }

        const token = jwt.sign(
            { userId: user.id },
            process.env.JWT_SECRET,
            {
                algorithm: "HS256",
                expiresIn: "1h"
            }
        );

        res.json({
            message: "Login successful",
            token: token,
            user: {
                id: user.id,
                name: user.name,
                email: user.email
            }
        });
    } catch (error) {
        console.error("Login error:", error.message);

        res.status(500).json({
            message: "Unable to log in"
        });
    }
});

// JWT authentication middleware
function authenticateToken(req, res, next) {
    const authHeader = req.headers.authorization;

    if (!authHeader || !authHeader.startsWith("Bearer ")) {
        return res.status(401).json({
            message: "Authentication token required"
        });
    }

    const token = authHeader.slice(7).trim();

    if (!token) {
        return res.status(401).json({
            message: "Authentication token required"
        });
    }

    try {
        const decoded = jwt.verify(
            token,
            process.env.JWT_SECRET,
            {
                algorithms: ["HS256"]
            }
        );

        req.userId = decoded.userId;

        next();
    } catch (error) {
        return res.status(401).json({
            message: "Invalid or expired token"
        });
    }
}

// Protected profile route
app.get("/profile", authenticateToken, (req, res) => {
    const user = users.find(
        item => item.id === req.userId
    );

    if (!user) {
        return res.status(401).json({
            message: "User no longer exists"
        });
    }

    res.json({
        id: user.id,
        name: user.name,
        email: user.email
    });
});

const PORT = process.env.PORT || 5000;

app.listen(PORT, () => {
    console.log(`Server running on port ${PORT}`);
});

9. Run the Application

Start the server from your project folder:

node server.js

Expected output:

Server running on port 5000

10. Login Using Postman

Send a POST request to:

http://localhost:5000/login

Choose Body → raw → JSON and enter:

{
    "email": "rahul@example.com",
    "password": "ExamplePass123"
}

Expected Response

{
    "message": "Login successful",
    "token": "eyJhbGciOiJIUzI1NiIs...",
    "user": {
        "id": 1,
        "name": "Rahul Kumar",
        "email": "rahul@example.com"
    }
}

The token shown above is illustrative. Your server generates a different token when you log in.

11. Access a Protected Route

After logging in, copy the returned token and send a GET request to:

http://localhost:5000/profile

In Postman:

1. Open the Authorization tab.
2. Select Bearer Token.
3. Paste the token received from the login endpoint.
4. Click Send.

Expected Response

{
    "id": 1,
    "name": "Rahul Kumar",
    "email": "rahul@example.com"
}

Without a valid token, the protected endpoint returns 401 Unauthorized.

12. Send a JWT from JavaScript

A frontend application can send a token in the Authorization header.

const token = "YOUR_TOKEN_FROM_LOGIN";

fetch("http://localhost:5000/profile", {
    method: "GET",
    headers: {
        "Authorization": "Bearer " + token
    }
})
.then(response => {
    if (!response.ok) {
        throw new Error("Request failed: " + response.status);
    }

    return response.json();
})
.then(data => console.log(data))
.catch(error => console.error(error));

13. JWT vs Session Authentication

14. Common JWT Errors

15. JWT Security Best Practices

• Use a strong, randomly generated signing secret.
• Keep signing secrets on the server.
• Set an appropriate token expiration time.
• Verify signatures and explicitly allow expected algorithms.
• Do not store passwords or other secrets in the token payload.
• Use HTTPS in production.
• Validate token claims and permissions before granting access.
• Plan for token revocation and account logout where needed.
• Use refresh tokens only with a carefully designed rotation and revocation strategy.
• Apply rate limiting to login and token-related endpoints.

16. Practical Assignment

17. Lesson Summary