Authentication System

A complete backend authentication system built with Node.js, ExpressJS, MongoDB, and Mongoose.

It demonstrates secure user registration, email verification, login, JWT access and refresh tokens, HttpOnly cookies, protected routes, logout, forgot password, and password reset flows.

Features

• User registration
• Password hashing with bcryptjs
• Email verification flow
• Resend verification flow
• Login with email and password
• JWT access tokens
• JWT refresh tokens
• HttpOnly authentication cookies
• Protected profile route
• Refresh access token flow
• Logout and session invalidation
• Forgot password flow
• Password reset flow
• Refresh token hashing
• Verification token hashing
• Password reset token hashing
• MongoDB integration
• Mongoose schema validation
• Request validation
• Centralized error handling
• Graceful shutdown
• Environment configuration
• Health check endpoint
• API testing with requests.http

Tech Stack

• Node.js
• ExpressJS
• MongoDB
• Mongoose
• bcryptjs
• JSON Web Token
• cookie-parser
• Nodemon

API Endpoints

Root

GET /

Health Check

GET /api/v1/health

Register

POST /api/v1/auth/register

Verify Email

POST /api/v1/auth/verify-email

Resend Verification

POST /api/v1/auth/resend-verification

Login

POST /api/v1/auth/login

Refresh Access Token

POST /api/v1/auth/refresh

Logout

POST /api/v1/auth/logout

Authenticated Profile

GET /api/v1/auth/profile

Forgot Password

POST /api/v1/auth/forgot-password

Reset Password

POST /api/v1/auth/reset-password

Environment

Create a .env file using .env.example:

PORT=1198
NODE_ENV=development

MONGODB_URI=mongodb://127.0.0.1:27017/authentication_system

JWT_ACCESS_SECRET=replace_with_a_strong_access_secret
JWT_REFRESH_SECRET=replace_with_a_strong_refresh_secret

JWT_ACCESS_EXPIRES_IN=15m
JWT_REFRESH_EXPIRES_IN=7d

ACCESS_COOKIE_MAX_AGE=900000
REFRESH_COOKIE_MAX_AGE=604800000

The .env file is ignored by Git. .env.example documents the required environment variables.

Installation

npm install

Development

npm run dev

Production

npm start

Default Port

1198

Authentication Flow

Register
   |
   v
Verify Email
   |
   v
Login
   |
   v
Access Token + Refresh Token Cookies
   |
   v
Protected Routes
   |
   v
Refresh Access Token
   |
   v
Logout

Password Reset Flow

Forgot Password
      |
      v
Generate Reset Token
      |
      v
Validate Reset Token
      |
      v
Set New Password
      |
      v
Invalidate Existing Refresh Session

Project Structure

authentication-system/
├── src/
│   ├── config/
│   │   └── database.js
│   ├── controllers/
│   │   └── auth.controllers.js
│   ├── middlewares/
│   │   ├── auth.middleware.js
│   │   ├── errorHandler.middleware.js
│   │   └── notFound.middleware.js
│   ├── models/
│   │   └── user.model.js
│   ├── routes/
│   │   └── auth.routes.js
│   ├── utils/
│   │   ├── cookie.utils.js
│   │   └── token.utils.js
│   ├── validators/
│   │   └── auth.validators.js
│   ├── app.js
│   └── server.js
├── .env.example
├── .gitignore
├── package.json
├── requests.http
└── README.md

Security Notes

• Passwords are hashed before storage.
• Raw refresh tokens are not stored in MongoDB.
• Verification and password-reset tokens are stored as hashes.
• Access and refresh tokens use separate secrets.
• Authentication cookies are HttpOnly.
• Protected routes validate access tokens before controller execution.
• Password reset invalidates the existing refresh session.

Documentation

Detailed project and code documentation is available in DOCUMENTATION.md.

Author

Ashish Ranjan

Links

• Portfolio: https://www.ashishranjan.net
• GitHub: https://github.com/a2rp
• CodePen: https://codepen.io/ash1198
• LinkedIn: https://www.linkedin.com/in/aashishranjan
• Facebook: https://www.facebook.com/theash.ashish/
• YouTube: https://www.youtube.com/@ashishranjan-ashz?sub_confirmation=1
• Email: mailto:ash.ranjan09@gmail.com

Support

• Support: https://a2rp-donation-page.netlify.app/
• Buy Me A Coffee: https://buymeacoffee.com/a2rp
• Patreon: https://patreon.com/a2rp

License

MIT License