Authentication & Security

// visit-counter.js — Manual cookie handling
const http = require('http');

const server = http.createServer((req, res) => {
  // Parse cookies from the request header
  const cookies = {};
  const cookieHeader = req.headers.cookie;
  if (cookieHeader) {
    cookieHeader.split(';').forEach(cookie => {
      const [name, value] = cookie.trim().split('=');
      cookies[name] = value;
    });
  }

  // Increment visit count
  const visits = parseInt(cookies.visits || '0') + 1;
  res.setHeader('Set-Cookie', `visits=${visits}; Max-Age=86400`);
  res.end(`You have visited ${visits} time(s)`);
});

server.listen(3000);

// visit-counter-express.js — Using cookie-parser
const express = require('express');
const cookieParser = require('cookie-parser');
const app = express();

app.use(cookieParser());

app.get('/', (req, res) => {
  const visits = parseInt(req.cookies.visits || '0') + 1;
  res.cookie('visits', visits, { maxAge: 86400000 });
  res.send(`You have visited ${visits} time(s)`);
});

app.listen(3000);

// session-auth.js — Complete session authentication
const express = require('express');
const session = require('express-session');
const crypto = require('crypto');
const app = express();

app.use(express.json());
app.use(session({
  secret: process.env.SESSION_SECRET || 'change-this-secret',
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.NODE_ENV === 'production',
    httpOnly: true,
    maxAge: 24 * 60 * 60 * 1000, // 24 hours
    sameSite: 'strict' // CSRF protection
  }
}));

// Fake user database (⚠️ SHA-256 is a DEMO shortcut — use bcrypt in real apps!)
const users = [
  { id: 1, email: 'alice@example.com',
    passwordHash: crypto.createHash('sha256').update('password123').digest('hex') }
];

// Login
app.post('/login', (req, res) => {
  const { email, password } = req.body;
  const hash = crypto.createHash('sha256').update(password).digest('hex');
  const user = users.find(u => u.email === email && u.passwordHash === hash);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });
  req.session.userId = user.id;
  res.json({ message: 'Logged in!' });
});

// Auth middleware
function requireAuth(req, res, next) {
  if (!req.session.userId) return res.status(401).json({ error: 'Not authenticated' });
  next();
}

// Protected route
app.get('/profile', requireAuth, (req, res) => {
  const user = users.find(u => u.id === req.session.userId);
  res.json({ user: { id: user.id, email: user.email } });
});

// Logout
app.post('/logout', (req, res) => {
  req.session.destroy();
  res.json({ message: 'Logged out' });
});

app.listen(3000, () => console.log('Server: http://localhost:3000'));

npm init -y
npm install express jsonwebtoken bcrypt dotenv

// jwt-auth.js — Complete JWT auth with refresh tokens
const express = require('express');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');
require('dotenv').config();

const app = express();
app.use(express.json());

const ACCESS_SECRET = process.env.ACCESS_SECRET || 'access-secret-change-me';
const REFRESH_SECRET = process.env.REFRESH_SECRET || 'refresh-secret-change-me';

// In-memory storage (use DB in production!)
const users = [];
let refreshTokens = [];

// Register
app.post('/register', async (req, res) => {
  const hash = await bcrypt.hash(req.body.password, 12);
  users.push({ id: users.length + 1, email: req.body.email, passwordHash: hash });
  res.status(201).json({ message: 'User registered!' });
});

// Login → issue access + refresh tokens
app.post('/login', async (req, res) => {
  const user = users.find(u => u.email === req.body.email);
  if (!user || !await bcrypt.compare(req.body.password, user.passwordHash)) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  const accessToken = jwt.sign({ userId: user.id }, ACCESS_SECRET, { expiresIn: '15m' });
  const refreshToken = jwt.sign({ userId: user.id }, REFRESH_SECRET, { expiresIn: '7d' });
  refreshTokens.push(refreshToken);
  res.json({ accessToken, refreshToken });
});

// Verify token middleware
function verifyToken(req, res, next) {
  const auth = req.headers.authorization;
  if (!auth?.startsWith('Bearer ')) return res.status(401).json({ error: 'No token' });
  try {
    req.user = jwt.verify(auth.split(' ')[1], ACCESS_SECRET);
    next();
  } catch {
    res.status(403).json({ error: 'Invalid or expired token' });
  }
}

// Refresh token endpoint
app.post('/token/refresh', (req, res) => {
  const { refreshToken } = req.body;
  if (!refreshTokens.includes(refreshToken)) return res.status(403).json({ error: 'Invalid refresh token' });
  try {
    const payload = jwt.verify(refreshToken, REFRESH_SECRET);
    const newAccessToken = jwt.sign({ userId: payload.userId }, ACCESS_SECRET, { expiresIn: '15m' });
    res.json({ accessToken: newAccessToken });
  } catch {
    res.status(403).json({ error: 'Expired refresh token' });
  }
});

// Protected route
app.get('/api/profile', verifyToken, (req, res) => {
  res.json({ userId: req.user.userId });
});

// Logout — remove refresh token from whitelist
app.post('/logout', (req, res) => {
  refreshTokens = refreshTokens.filter(t => t !== req.body.refreshToken);
  res.json({ message: 'Logged out' });
});

app.listen(3000, () => console.log('JWT server: http://localhost:3000'));

npm install express passport passport-google-oauth20 express-session dotenv

GOOGLE_CLIENT_ID=your-client-id-here
GOOGLE_CLIENT_SECRET=your-client-secret-here
SESSION_SECRET=a-very-long-random-string

// oauth-google.js — Complete Google OAuth with Passport.js
const express = require('express');
const passport = require('passport');
const GoogleStrategy = require('passport-google-oauth20').Strategy;
const session = require('express-session');
require('dotenv').config();

const app = express();

// Session setup (Passport needs sessions)
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false, saveUninitialized: false
}));

app.use(passport.initialize());
app.use(passport.session());

// User storage (use a real DB in production!)
const users = [];

// Configure Google Strategy
passport.use(new GoogleStrategy({
    clientID: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    callbackURL: '/auth/google/callback'
  },
  (accessToken, refreshToken, profile, done) => {
    // Find or create user
    let user = users.find(u => u.googleId === profile.id);
    if (!user) {
      user = {
        id: users.length + 1,
        googleId: profile.id,
        name: profile.displayName,
        email: profile.emails[0].value
      };
      users.push(user);
    }
    done(null, user);
  }
));

// Serialize/deserialize user for sessions
passport.serializeUser((user, done) => done(null, user.id));
passport.deserializeUser((id, done) => {
  const user = users.find(u => u.id === id);
  done(null, user);
});

// Routes
app.get('/auth/google',
  passport.authenticate('google', { scope: ['profile', 'email'] })
);

app.get('/auth/google/callback',
  passport.authenticate('google', { failureRedirect: '/' }),
  (req, res) => res.redirect('/dashboard')
);

app.get('/dashboard', (req, res) => {
  if (!req.user) return res.redirect('/');
  res.send(`Welcome ${req.user.name}! Email: ${req.user.email}`);
});

app.get('/', (req, res) => {
  res.send('<a href="/auth/google">Login with Google</a>');
});

app.listen(3000, () => console.log('OAuth server: http://localhost:3000'));

// npm install bcrypt
const bcrypt = require('bcrypt');

// Registration: hash the password
const SALT_ROUNDS = 12; // higher = slower = more secure

app.post('/register', async (req, res) => {
  const { email, password } = req.body;

  if (password.length < 8) {
    return res.status(400).json({ error: 'Password too short' });
  }

  const passwordHash = await bcrypt.hash(password, SALT_ROUNDS);
  // passwordHash = "$2b$12$LJ3m4ys..." (60 chars, includes salt)

  await createUser({ email, passwordHash });
  res.status(201).json({ message: 'User created' });
});

// Login: compare password with hash
app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await findUserByEmail(email);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });

  const isMatch = await bcrypt.compare(password, user.passwordHash);
  if (!isMatch) return res.status(401).json({ error: 'Invalid credentials' });

  // ✅ Password matches — create session or JWT
});

const { body, validationResult } = require('express-validator');

app.post('/register',
  body('email').isEmail().normalizeEmail(),
  body('password').isLength({ min: 8 }).escape(),
  body('name').trim().notEmpty().escape(),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    // ✅ Input is validated and sanitized, safe to proceed
  }
);