🔑 Authentication (Login Signup with JWT

Now you learn how real apps handle users and security.

👉 Every real app needs:
• Signup (register)
• Login (authenticate)
• Protected routes

🧠 What is Authentication
Authentication = verifying who the user is
Example:
• Login with email + password
• System checks credentials
• Grants access

🔑 What is JWT
JWT = JSON Web Token
👉 A secure token sent after login
👉 Used to identify user in future requests
Simple flow:
1️⃣ User logs in
2️⃣ Server creates token
3️⃣ Token sent to frontend
4️⃣ Frontend sends token in every request

📦 Install Required Packages
npm install jsonwebtoken bcryptjs
• jsonwebtoken → create token
• bcryptjs → hash passwords

🧩 Step 1 — User Schema
const mongoose = require("mongoose");
const userSchema = new mongoose.Schema({
email: String,
password: String
});
const User = mongoose.model("User", userSchema);

🔐 Step 2 — Signup API
const bcrypt = require("bcryptjs");
app.post("/signup", async (req, res) => {
const hashedPassword = await bcrypt.hash(req.body.password, 10);
const user = new User({
email: req.body.email,
password: hashedPassword
});
await user.save();
res.json({ message: "User registered" });
});
✔ Password is stored securely
✔ Never store plain text password

🔓 Step 3 — Login API
const jwt = require("jsonwebtoken");
app.post("/login", async (req, res) => {
const user = await User.findOne({ email: req.body.email });
if (!user) {
return res.status(400).json({ message: "User not found" });
}
const isMatch = await bcrypt.compare(req.body.password, user.password);
if (!isMatch) {
return res.status(400).json({ message: "Invalid credentials" });
}
const token = jwt.sign(
{ userId: user._id },
"secretkey",
{ expiresIn: "1h" }
);
res.json({ token });
});
✔ Validates user
✔ Generates token

🛡️ Step 4 — Protect Routes (Middleware)
const authMiddleware = (req, res, next) => {
const token = req.headers.authorization;
if (!token) {
return res.status(401).json({ message: "Access denied" });
}
try {
const verified = jwt.verify(token, "secretkey");
req.user = verified;
next();
} catch {
res.status(400).json({ message: "Invalid token" });
}
};

🔒 Step 5 — Use Protected Route
app.get("/profile", authMiddleware, (req, res) => {
res.json({ message: "Welcome user", user: req.user });
});
✔ Only logged-in users can access

🔄 Full Authentication Flow
Signup → Store user
Login → Verify user → Generate token
Frontend stores token
Frontend sends token in requests
Backend verifies token

⚠️ Common Beginner Mistakes
• Storing plain passwords ❌
• Not hashing passwords ❌
• Exposing secret key ❌
• Not verifying token ❌

🧪 Mini Practice Task
Build authentication system:
• POST /signup
• POST /login
• GET /dashboard (protected route)
• Use JWT middleware

Double Tap ♥️ For More