User authentication for Node.js website

Question

I am building a website based on Node.js.

The approach that I am following to ensure safety of the APIs is as follows:

The user signs up with email and password.
On successfull signup and login, the client receives a random generated token
It stores the token in local storage and passes the token as header in all subsequent requests.
For every subsequent request the server checks the token and validates the user.
Once the user logs out,the token stored in client's local storage gets deleted
The user gets a new token when he logs in again.

Is the above approach good enough?Please suggest better ways if any.

Also I have seen people using passport-local for authentication purpose. How can passport-local help in the above way of authentication?

Aminadav Glickshtein · Accepted Answer · 2017-09-18 18:46:05Z

3

It is not a good approach because of many reasons. For example:

In your approach, the user will not be able to log in from two browsers (Mobile+Desktop) at the same time.
It's very easy to steal a localStorage data by XSS attack. If you use server only Cookie, it's much harder.

answered Sep 18, 2017 at 18:46

Aminadav Glickshtein

24.8k13 gold badges84 silver badges118 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Risto Novik · Accepted Answer · 2017-09-18 20:09:56Z

2

Instead of random tokens, it would be better to use Json Web Token (https://jwt.io/introduction/). This would give you the easy way to verify the token is valid (the tokens are signed and has expiration time).

answered Sep 18, 2017 at 20:09

Risto Novik

8,30511 gold badges52 silver badges67 bronze badges

Collectives™ on Stack Overflow

User authentication for Node.js website

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related