Introduction to User Authentication with Node.js and Express.js

Hello! Today, we're unraveling a cornerstone of web application security - User Authentication. User Authentication involves verifying user identities during login attempts. By correctly implementing User Authentication, you can significantly protect your applications from unauthorized access and potential security threats. Our toolkit for today includes Node.js and Express.js for crafting our server-side application, and MongoDB with Mongoose for managing our users' data.

⚠️ Important Note: This lesson demonstrates basic authentication concepts for educational purposes only. The techniques shown here (such as storing plain-text passwords and passing credentials via query parameters) are NOT secure and should never be used in production applications. In real-world applications, you must use proper security measures such as password hashing (bcrypt), secure session management, HTTPS, and industry-standard authentication libraries.

Next, we'll delve into MongoDB, a powerful NoSQL database, and Mongoose, a MongoDB object modeling tool designed to work in an asynchronous environment. They'll assist us in storing and managing user data in a structured manner.

Let's dive straight in and create a User Model, comprising username and password attributes:

var mongoose = require('mongoose'); // Importing the Mongoose library
var Schema = mongoose.Schema; // Retrieving the Schema object from Mongoose
var UserSchema = new Schema({
  username: String, // Setting the username attribute as a string
  password: String, // Setting the password attribute as a string
});
var User = mongoose.model('User', UserSchema); // Creating a User model with the above schema

Here, mongoose.model is used to create a User model in our MongoDB database. Each User document in our database will have a username and password field.

Now, let's apply the final touches and create our authentication middleware. Middleware in Express provides a way to work with request and response objects in your application. Middleware functions can perform tasks such as modifying these objects, ending the request-response cycle, or invoking the next middleware function in the stack.

Here's a basic authentication middleware function:

var authMiddleware = function (req, res, next) {
  if (req.query.username === "admin" && req.query.password === "admin") {
   // If the user is authenticated, the next function is invoked
    console.log("User authenticated");
    next();
  } else {
   // If credentials are invalid, we respond with 'Invalid credentials'
    res.status(401).send({ message: "Invalid credentials" });
  }
};

This authMiddleware checks whether the submitted username and password match the known credentials. If they match, the next function in the middleware stack is invoked; otherwise, the response 'Invalid credentials' is sent.