CODEWITHSUNDEEP
node.jsexpresssecuritymongoosejwt
Adwaith
Adwaith

Reputation: 1229

Json Web Token security [ Node JS ]

This post is just to know whether my method/code does not introduce any overheads and is enough interms of security. Technology used: NodeJS, JWT, ExpressJS, mongoose(mongoDB)

The following is the userschema:

const userSchema = mongoose.Schema({
email: {
    type: String,
    required: true
},
password: {
    type: String,
    required: true
},
accessToken: {
    type: String
}
});

Now my code implements the following:

Is this enough to provide security, interms of token management? Is there anything mandatory which I am missing?

Thank you.

Upvotes: 0

Views: 80

Answers (1)

Marek Puchalski
Marek Puchalski

Reputation: 3659

I believe your application has... a bit potential for improvement. Look:

  1. You are not supposed to store the JWT tokens in the database. You are supposed to validate the signature of the JWT token to verify, if you can trust the token.
  2. By having all the tokens stored in the database, you have a single point of failure. Once your DB is hacked, everyone is hacked.
  3. The logout endpoint is not supposed to need authentication or the token. Do you want your user with invalid token to be redirected to the login page so he can log out?

Please read about how JWT tokens are to be used: https://jwt.io/introduction/

Once you did that have a look what are the most common security concerns regarding JWT tokens: https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html

Upvotes: 1

Related Questions