User Authentication Level 5:

Advanced Security with Multi-Strategy Authentication

Mohammed Shakeel's photo
Mohammed Shakeel
·

19 min read

User Authentication Level 5:

In this guide, we'll explore Level 5 User Authentication, integrating local authentication (email and password) with Google OAuth. This implementation leverages industry standards to secure user data while offering seamless login options.

Key Features

  1. Local Authentication: Traditional email-password-based authentication.

  2. Google OAuth Integration: Enable users to log in using their Google accounts.

  3. Secure Session Management: Sessions are stored securely using environment variables for secrets.

  4. Password Hashing: Employing bcrypt to hash passwords for secure storage.

Code Walkthrough

1. Setting Up the Environment

Environment variables are critical to hiding sensitive information. Using the dotenv library, we securely load configurations.

Environment Variables (.env file):

SESSION_SECRET="YourSessionSecret"
PG_USER="yourDatabaseUser"
PG_HOST="localhost"
PG_DATABASE="yourDatabase"
PG_PASSWORD="yourDatabasePassword"
PG_PORT="5432"
GOOGLE_CLIENT_ID="yourGoogleClientID"
GOOGLE_CLIENT_SECRET="yourGoogleClientSecret"

Code Snippet:

import env from "dotenv";
env.config();

This ensures sensitive information, such as database credentials and API keys, is not hard-coded into the application.

2. Middleware Configuration

Middleware is a crucial part of Express applications. It acts as a bridge that handles various tasks such as session management, parsing incoming data, and initializing authentication processes. Here’s a detailed explanation of the middleware used in this feature.

Code:

import session from "express-session";
import bodyParser from "body-parser";
import passport from "passport";

app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: true,
}));
app.use(bodyParser.urlencoded({ extended: true }));
app.use(passport.initialize());
app.use(passport.session());

Components and Their Roles:

  1. express-session

    • Purpose: Manages session data securely across multiple requests from the same client.

    • Session Storage: Stores session data on the server and uses cookies to identify clients.

    • Security: The secret key, sourced from environment variables (SESSION_SECRET), ensures session data is signed and cannot be tampered with by the client.

    • Configuration Options:

      • resave: false: Prevents unnecessary session saving when no changes are made.

      • saveUninitialized: true: Ensures that uninitialized sessions (sessions with no data) are saved to the store.

    • Real-World Use: Tracks users during authentication, ensuring that after login, their identity persists across page visits without requiring re-login.

  1. body-parser

    • Purpose: Simplifies the handling of incoming HTTP requests by parsing their payload.

    • Feature:

      • urlencoded({ extended: true }): Allows the server to handle complex nested objects in the request body, typically from HTML form submissions.

    • Why Needed?: Forms submitted by users for login or registration often contain data in the request body. Without parsing, this data would be unreadable to the application.

  1. passport

    • Purpose: Passport is a powerful authentication middleware that supports various authentication mechanisms, including local strategies and third-party integrations (e.g., Google, Facebook).

    • Initialization:

      • passport.initialize(): Sets up Passport for the application, enabling authentication logic.

      • passport.session(): Ensures user sessions are maintained after authentication, leveraging express-session.

    • Why Important?: Passport abstracts away the complexity of authentication, providing a unified interface for handling user logins, session persistence, and logout.

Flow of Middleware Configuration:

  1. Session Management:
    A session is created when a user logs in. It is identified using a session cookie sent to the client. The server can retrieve the session data for subsequent requests using this cookie.

  2. Parsing Form Data:
    When a user submits login or registration forms, body-parser ensures the form fields are parsed into an object, such as { username: "john_doe", password: "123456" }. This parsed data is accessible via req.body.

  3. Authentication Initialization:
    Passport integrates into the app by initializing its logic (initialize) and tying user sessions to Express's session management (session). This allows persistent login states without needing manual management.

Example Usage:

Here’s how these middlewares come together in practice:

  • A user submits a login form with their credentials.

  • body-parser parses the form data, making it available in req.body.

  • Passport processes the credentials and authenticates the user.

  • express-session creates a session and stores the user’s details securely.

  • On subsequent requests, Passport checks the session, validates the user, and allows them to access protected routes.

Why Middleware Matters?

  • Efficiency: Middleware reduces repetitive code by centralizing common tasks such as parsing and session handling.

  • Scalability: Easily integrate additional features (e.g., rate limiting, CORS) by adding new middleware layers.

  • Security: Middleware like express-session ensures sensitive data is handled securely, preventing vulnerabilities such as session hijacking.

Key Takeaways:

The combination of express-session, body-parser, and passport provides a robust foundation for user authentication and session management. It streamlines processes like user login, session persistence, and form data handling, making the application both secure and efficient.

3. Database Connection

Establishing a secure and efficient connection to a database is a cornerstone of any application that manages user data. In this application, PostgreSQL is used as the database for storing and retrieving user credentials and other authentication-related information.

Code:

import pg from "pg";

const db = new pg.Client({
  user: process.env.PG_USER,
  host: process.env.PG_HOST,
  database: process.env.PG_DATABASE,
  password: process.env.PG_PASSWORD,
  port: process.env.PG_PORT,
});

db.connect();

Detailed Explanation:

  1. Database Driver (pg):

    • PostgreSQL is a highly reliable and scalable relational database.

    • The pg library is a Node.js driver for PostgreSQL, allowing interaction with the database by executing SQL queries.

  1. Configuration Object:
    The pg.Client object is configured using credentials and parameters defined in environment variables. Each property serves a distinct purpose:

    • user: The database username used to authenticate connections.

    • host: The address where the PostgreSQL server is running. Typically localhost for development or a remote server for production.

    • database: The name of the database to connect to. This helps organize data, especially in applications managing multiple databases.

    • password: The password associated with the database user account.

    • port: The port number on which the PostgreSQL server listens for connections, commonly 5432.

Why Use Environment Variables?

  • Credentials are sensitive information. Storing them in a .env file and accessing them via process.env enhances security, as they are not hardcoded into the application. This practice also makes the application portable and easier to configure for different environments (e.g., development, staging, production).

  1. Establishing a Connection (db.connect):

    • The connect() method initializes a connection to the database, allowing the application to perform queries like inserting, updating, or retrieving user data.

    • If the connection fails, an error is thrown, which should be handled gracefully (e.g., logging the error and retrying or sending a user-friendly message).

Purpose of Database Connection:

  • User Registration:
    When a user registers, their details (e.g., email and hashed password) are inserted into the database.

  • User Login:
    During login, the database is queried to verify whether the entered email exists and whether the password matches the stored hash.

  • Google OAuth:
    When a user logs in via Google, the database is queried to check if the user already exists. If not, their profile is added to the database.

Security Considerations:

  1. Environment Variables:

    • Avoid exposing database credentials by storing them securely in a .env file and not committing this file to version control.

  2. Error Handling:

    • Ensure detailed database errors are not sent to clients. For instance, instead of exposing raw SQL error messages, log them on the server and return a generic message like "An error occurred. Please try again."

  3. Connection Pooling:

    • In production, use a connection pool instead of a single client to manage multiple concurrent connections efficiently.

  4. SQL Injection Prevention:

    • Use parameterized queries ($1, $2, etc.) to prevent SQL injection attacks.

Example Query Workflow:

  1. Registration:

    • The application sends an SQL query:

        INSERT INTO users (email, password) VALUES ($1, $2);

    • The values for $1 and $2 are user-provided data securely passed as parameters.

  2. Login:

    • The application queries the database:

        SELECT * FROM users WHERE email = $1;

    • The result is used to verify the provided password against the stored hashed password.

  3. Google OAuth:

    • The application checks if the user's email already exists:

        SELECT * FROM users WHERE email = $1;

    • If not, a new entry is inserted.

Key Takeaways:

  • The database connection is critical for handling user-related operations, such as authentication and registration.

  • Environment variables and proper error handling significantly enhance the security and reliability of the application.

  • PostgreSQL, combined with the pg library, offers a robust and efficient solution for managing user data in Node.js applications.

4. Local Authentication

Local authentication involves user registration and login using an email and password. This ensures a secure, streamlined process for managing user credentials and granting access to the application.

Feature: User Registration

Code:
import bcrypt from "bcrypt";

app.post("/register", async (req, res) => {
  const email = req.body.username;
  const password = req.body.password;

  try {
    // Check if the email already exists in the database
    const checkResult = await db.query("SELECT * FROM users WHERE email = $1", [email]);
    if (checkResult.rows.length > 0) {
      return res.redirect("/login");
    }

    // Hash the password before storing it in the database
    bcrypt.hash(password, 10, async (err, hash) => {
      if (err) console.error(err);
      else {
        const result = await db.query(
          "INSERT INTO users (email, password) VALUES ($1, $2) RETURNING *",
          [email, hash]
        );
        const user = result.rows[0];

        // Log the user in automatically after successful registration
        req.login(user, (err) => res.redirect("/secrets"));
      }
    });
  } catch (err) {
    console.error(err);
  }
});

Detailed Explanation:

  1. Password Hashing:

    • The bcrypt.hash() method hashes the user's password using a salt (a random value added to the hash process).

    • Hashing ensures that the original password is not stored in the database, protecting user data in case of a breach.

  2. Duplicate Email Check:

    • The query SELECT * FROM users WHERE email = $1 checks if the email already exists in the database.

    • If the email exists, the registration request is redirected to the login page (res.redirect("/login")), ensuring no duplicate accounts.

  3. Storing User Data:

    • After hashing the password, the INSERT INTO query stores the email and hashed password in the database.

    • The RETURNING * clause retrieves the newly created user data for immediate use.

  4. Automatic Login:

    • After successful registration, the req.login() method logs the user in automatically.

    • This improves user experience by bypassing the need for immediate re-login.

  5. Error Handling:

    • All database and hashing operations are wrapped in a try-catch block to handle errors gracefully.

Feature: User Login

Code:
import passportLocal from "passport-local";

passport.use("local", new passportLocal.Strategy(async (username, password, cb) => {
  try {
    // Query the database for the user with the provided email
    const result = await db.query("SELECT * FROM users WHERE email = $1", [username]);
    if (result.rows.length === 0) {
      return cb(null, false, { message: "User not found" });
    }

    const user = result.rows[0];

    // Validate the password by comparing it with the stored hash
    bcrypt.compare(password, user.password, (err, valid) => {
      if (err) return cb(err);
      return cb(null, valid ? user : false);
    });
  } catch (err) {
    return cb(err);
  }
}));

Detailed Explanation:

  1. Passport Local Strategy:

    • passport-local is a Passport.js strategy for authenticating users using a username (email) and password.

    • It defines the logic for validating user credentials.

  2. Database Query:

    • The query SELECT * FROM users WHERE email = $1 searches for a user with the provided email.

    • If no user is found, the callback (cb) returns false with a message indicating the user was not found.

  3. Password Validation:

    • The bcrypt.compare() method checks whether the input password matches the stored hashed password.

    • This ensures secure comparison without exposing the original password.

  4. Authentication Result:

    • If the password is valid, the callback (cb) returns the user object.

    • If invalid, the callback returns false, indicating authentication failure.

  5. Error Handling:

    • Errors during database queries or password validation are caught and passed to the callback for proper handling.

Key Security Measures:

  1. Password Hashing:

    • Storing passwords in hashed form ensures that even if the database is compromised, original passwords remain secure.

  2. Salt Usage:

    • The salt added during hashing ensures that identical passwords produce different hashes, preventing dictionary attacks.

  3. Authentication Feedback:

    • Clear but generic error messages (e.g., "User not found") are provided to avoid revealing unnecessary information about the system.

  4. Session Management:

    • Upon successful login, the user's session is managed securely using passport.

User Workflow:

  1. Registration:

    • The user enters an email and password.

    • If the email is unique, the password is hashed and stored securely.

    • The user is logged in automatically and redirected to a secure page.

  2. Login:

    • The user enters an email and password.

    • If the credentials are valid, they are authenticated and granted access to the application.

Takeaways:

  • Local authentication is simple to implement using Node.js, PostgreSQL, and Passport.js.

  • Security practices like password hashing, duplicate checks, and error handling ensure the system is robust.

  • Auto-login post-registration improves user experience significantly.

5. Google OAuth Integration

Google OAuth integration enables users to log in securely using their Google accounts. This simplifies the login process by leveraging Google's secure authentication mechanism and avoids the need for users to create new credentials.

Code Walkthrough

Configuration: Setting Up the Google Strategy
import { Strategy as GoogleStrategy } from "passport-google-oauth2";

passport.use("google", new GoogleStrategy(
  {
    clientID: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    callbackURL: "http://localhost:3000/auth/google/secrets",
  },
  async (accessToken, refreshToken, profile, cb) => {
    try {
      // Check if the user already exists in the database
      const result = await db.query("SELECT * FROM users WHERE email = $1", [profile.email]);
      if (result.rows.length === 0) {
        // Register the user if not found
        const newUser = await db.query(
          "INSERT INTO users (email, password) VALUES ($1, $2)",
          [profile.email, "google"]
        );
        return cb(null, newUser.rows[0]); // Return the newly created user
      } else {
        return cb(null, result.rows[0]); // Return the existing user
      }
    } catch (err) {
      return cb(err); // Handle errors during the process
    }
  }
));

Explanation:

  1. GoogleStrategy:

    • The passport-google-oauth2 library provides the GoogleStrategy to integrate Google's OAuth 2.0 authentication.

    • The configuration object includes:

      • clientID: Google API client ID (retrieved from the Google Cloud Console).

      • clientSecret: Google API client secret.

      • callbackURL: The URL to which Google redirects after successful authentication.

  2. Authentication Flow:

    • Access Tokens: accessToken allows access to the Google API on the user's behalf.

    • Profile Retrieval: The profile object contains user information (e.g., email and name) provided by Google.

  3. Database Integration:

    • Queries the users table to check if the user already exists (SELECT * FROM users WHERE email = $1).

    • If the user does not exist, they are registered with their email and a placeholder password ("google").

    • The result is returned to the callback (cb) for further processing.

  4. Error Handling:

    • Errors during database queries or user creation are caught and passed to the callback.

Route: Initiating Authentication

app.get("/auth/google", passport.authenticate("google", { scope: ["profile", "email"] }));

Explanation:

  • Endpoint: /auth/google initiates the authentication process.

  • Scope: Specifies the permissions being requested from Google. In this case:

    • profile: Basic user profile information (e.g., name and avatar).

    • email: The user’s email address.

  • Redirect to Google: Redirects the user to the Google login page.

Route: Handling Authentication Callback

app.get("/auth/google/secrets", passport.authenticate("google", {
  successRedirect: "/secrets",
  failureRedirect: "/login",
}));

Explanation:

  • Endpoint: /auth/google/secrets is the callback URL specified in the GoogleStrategy.

  • Authentication Outcome:

    • On successful authentication, the user is redirected to /secrets.

    • On failure, the user is redirected to /login.

Key Features

  1. Seamless Login:

    • Users can log in using their Google accounts without creating separate credentials for the application.

  2. Secure User Data:

    • All authentication is handled securely via OAuth 2.0, reducing the risk of credential theft.

  3. Database Integration:

    • Automatically registers new users with their Google-provided email, ensuring a consistent user database.

  4. Reusability:

    • Once authenticated, the user’s session is managed by Passport, simplifying subsequent requests.

Security Considerations

  1. Environment Variables:

    • clientID and clientSecret are securely stored in environment variables to prevent exposure.

  2. Error Handling:

    • Errors during the authentication or database process are logged and handled to avoid revealing sensitive details to users.

  3. Token Management:

    • Although not explicitly shown, access and refresh tokens should be managed carefully if additional Google API access is needed.

User Workflow

  1. Start Authentication:

    • The user clicks a "Login with Google" button, triggering a request to /auth/google.

  2. Authenticate with Google:

    • The user logs in to their Google account and grants the requested permissions.

  3. Callback Processing:

    • Google redirects the user to /auth/google/secrets with their profile data.

  4. Database Check:

    • The application checks if the user exists in the database and either logs them in or registers them.

  5. Access Secured Content:

    • The user is redirected to the /secrets page upon successful authentication.

Benefits of Google OAuth Integration

  1. Ease of Use:

    • Eliminates the need for users to remember another password, improving user experience.

  2. Security:

    • Relies on Google's robust authentication infrastructure, enhancing overall security.

  3. Scalability:

    • Easily accommodates additional OAuth providers (e.g., Facebook or GitHub) for expanded options.

6. Session Management

Session management ensures that users remain authenticated across multiple requests after logging in. By serializing and deserializing user data, Passport.js securely tracks and retrieves user information without requiring repeated authentication.

Code Walkthrough

Serialization
passport.serializeUser((user, cb) => cb(null, user.id));

Explanation:

  1. Purpose: Converts the user object into a unique identifier (typically the user ID) that can be stored in the session.

  2. Process:

    • When a user logs in successfully, Passport calls serializeUser.

    • It receives the user object (e.g., { id: 1, email: "example@example.com" }) from the authentication process.

    • The unique identifier (user.id) is extracted and passed to the callback (cb), storing it in the session.

  3. Efficiency:

    • Storing only the user ID reduces memory usage compared to saving the entire user object.

Deserialization

passport.deserializeUser(async (id, cb) => {
  try {
    const result = await db.query("SELECT * FROM users WHERE id = $1", [id]);
    return cb(null, result.rows[0]);
  } catch (err) {
    return cb(err);
  }
});

Explanation:

  1. Purpose: Retrieves the full user object from the database based on the serialized user ID stored in the session.

  2. Process:

    • When an authenticated user makes a request, Passport calls deserializeUser.

    • The id is fetched from the session and used to query the database.

    • The result (e.g., { id: 1, email: "example@example.com" }) is reconstructed and passed to the callback (cb), making it available in req.user.

  3. Error Handling:

    • If the database query fails, the error is passed to the callback for proper handling, preventing disruptions in the application.

How It Works

  1. Login Process:

    • Upon successful login, Passport serializes the user ID into the session via serializeUser.

  2. Subsequent Requests:

    • For every new request, the session ID is checked, and deserializeUser retrieves the full user object from the database.

    • This ensures the user remains authenticated without needing to log in again.

  3. User Object Availability:

    • The reconstructed user object (req.user) is accessible in route handlers, enabling personalized responses and data fetching.

Benefits of Serialization and Deserialization

  1. Security:

    • Only the user ID is stored in the session, minimizing exposure of sensitive data.

    • Actual user details are fetched from the database, ensuring the latest information is used.

  2. Scalability:

    • Storing small identifiers in the session reduces memory usage, making the application more efficient for a large user base.

  3. Convenience:

    • The authenticated user's details are always available (req.user) without requiring redundant queries or authentication.

Example Workflow

  1. User Logs In:

    • Passport authenticates the user, and their ID is serialized into the session.

    • Example: { sessionID: "abc123", userID: 1 }.

  2. Subsequent Requests:

    • On each request, the session ID is used to retrieve the user ID.

    • deserializeUser queries the database to reconstruct the user object.

  3. User Data Access:

    • The user object is made available to the application via req.user.

Key Points to Consider

  1. Database Queries:

    • Ensure that the database is optimized for quick lookups of user data by ID, as deserialization happens on every authenticated request.

  2. Error Handling:

    • Proper error handling during deserialization ensures seamless operation even if database issues arise.

  3. Session Expiry:

    • Configure session expiration to enhance security by limiting the duration of user sessions.

  4. Cross-Platform Compatibility:

    • This approach works seamlessly with various session storage solutions (e.g., in-memory, Redis, or database-backed stores).

Security Considerations

  1. Session Hijacking:

    • Use secure cookies and HTTPS to prevent session ID theft.

  2. Session Management:

    • Implement session rotation on login to minimize risks from stolen session IDs.

  3. Data Validation:

    • Ensure proper validation of user IDs during deserialization to prevent unauthorized access.

Session management is essential for maintaining a consistent and secure user experience. By serializing user IDs into sessions and deserializing them when needed, the application achieves a balance between security, efficiency, and usability.

7. Protected Routes

Protected routes restrict access to specific pages or resources in an application, ensuring that only authenticated users can view or interact with sensitive content. This mechanism adds an essential layer of security to prevent unauthorized access.

Code Walkthrough

app.get("/secrets", (req, res) => {
  if (req.isAuthenticated()) {
    res.render("secrets.ejs");
  } else {
    res.redirect("/login");
  }
});

Explanation of Each Component

1. req.isAuthenticated()

  • Purpose:

    • This method is provided by Passport.js to verify whether the user is authenticated.

    • It checks the session data created during the login process to determine if the user has a valid session.

  • How It Works:

    • When a user logs in, their authentication state is stored in the session using Passport's serialization process.

    • On subsequent requests, req.isAuthenticated() examines the session to confirm the user's identity.

    • If the session contains valid authentication data, the method returns true. Otherwise, it returns false.

  • Result:

    • If the user is authenticated, they gain access to the requested page.

    • If not, the application takes an alternate route, such as redirecting to a login page.

2. Rendering Protected Content

res.render("secrets.ejs");

  • Purpose:

    • Renders the "secrets" page (a sensitive or restricted page) for authenticated users.

    • The secrets.ejs file might include information or features accessible only to logged-in users.

  • Security Note:

    • Ensure that sensitive data displayed on the page is not leaked in the client-side code (e.g., through JavaScript variables or hidden fields).

3. Redirection for Non-Authenticated Users

res.redirect("/login");

  • Purpose:

    • Redirects users who are not authenticated to the login page (/login).

    • This ensures only verified users can access protected routes.

  • User Experience:

    • Non-authenticated users are guided to the login page seamlessly.

    • After successful login, they can be redirected back to their original destination.

How It Works

  1. User Attempts to Access /secrets:

    • A user sends a GET request to /secrets.

  2. Authentication Check:

    • The req.isAuthenticated() method verifies if the user is authenticated by examining their session.

  3. Conditional Behavior:

    • Authenticated Users:

      • If the user is authenticated, the secrets.ejs page is rendered, displaying its content.

    • Non-Authenticated Users:

      • If the user is not authenticated, they are redirected to /login.

Benefits of Protected Routes

  1. Security:

    • Prevents unauthorized access to sensitive pages, such as user profiles, dashboards, or admin panels.

  2. Personalization:

    • Enables the application to display content tailored to authenticated users (e.g., account details or personalized data).

  3. Compliance:

    • Helps meet privacy and data protection regulations by restricting access to personal or confidential information.

Enhancements and Best Practices

  1. Middleware for Reusability:

    • Instead of duplicating authentication checks in every route, create a middleware function:

        function isAuthenticated(req, res, next) {
    if (req.isAuthenticated()) {
      return next();
    }
    res.redirect("/login");
  }

  app.get("/secrets", isAuthenticated, (req, res) => {
    res.render("secrets.ejs");
  });

    • This approach simplifies code maintenance and ensures consistency across protected routes.

  2. Redirect Back After Login:

    • Preserve the user’s original destination so they can return after logging in:

        app.get("/secrets", (req, res) => {
    if (req.isAuthenticated()) {
      res.render("secrets.ejs");
    } else {
      res.redirect(`/login?redirectTo=/secrets`);
    }
  });

  3. Session Timeout:

    • Implement session expiration to enhance security by logging out inactive users automatically.

  4. Custom Error Pages:

    • Provide a user-friendly error page instead of directly redirecting to the login page for a better user experience.

Security Considerations

  1. Session Hijacking:

    • Use secure cookies and HTTPS to protect session IDs from being intercepted.

  2. Token-Based Authentication:

    • For RESTful APIs or SPAs, consider using tokens (e.g., JWT) instead of sessions for authentication.

  3. Rate Limiting:

    • Limit login attempts to mitigate brute-force attacks.

Protected routes are a cornerstone of secure web applications. By checking authentication status before granting access, you safeguard sensitive resources and ensure a secure, seamless user experience.

Conclusion

With Level 5 User Authentication, you combine robust local authentication with a seamless Google OAuth experience. Proper session handling, password security, and the use of environment variables ensure that your application remains secure and user-friendly. By adhering to best practices, you can protect sensitive information and build trust with your users.

OAuth2google authenticatormulti-strategyauthenticationWeb DevelopmentNode.jsExpressPostgreSQL