Skip to main content

Explain how authentication and authorization work in a MERN stack application.

 Let's walk through authentication and authorization in a MERN stack application (MongoDB, Express.js, React, Node.js). These are critical for securing your app and controlling user access.

Explain how authentication and authorization work in a MERN stack application.

🔐 Authentication vs. Authorization

  • Authentication: Proves who the user is (e.g., logging in).

  • Authorization: Controls what that authenticated user can do (e.g., admin vs. regular user access).

⚙️ How It Works in the MERN Stack

1. React (Frontend)

  • Users enter credentials via a login form.

  • On submit, React sends a POST request to an Express.js backend.

  • If the credentials are valid, the server returns a JWT (JSON Web Token).

  • The JWT is stored client-side (e.g., localStorage, sessionStorage, or httpOnly cookies for better security).

  • For all protected routes, React sends this JWT in the Authorization header of future requests.

2. Express.js + Node.js (Backend)

Login Endpoint

  • Backend receives login credentials.

  • Looks up the user in MongoDB.

  • Compares hashed passwords using bcrypt.

  • If valid, creates a JWT using jsonwebtoken and sends it back.


const jwt = require('jsonwebtoken');
const bcrypt = require('bcryptjs');

app.post('/login', async (req, res) => {
  const user = await User.findOne({ email: req.body.email });
  if (!user) return res.status(401).send("User not found");

  const isMatch = await bcrypt.compare(req.body.password, user.password);
  if (!isMatch) return res.status(401).send("Incorrect password");

  const token = jwt.sign({ id: user._id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' });
  res.json({ token });
});

Middleware to Protect Routes

  • You create a middleware function to validate JWTs and attach user data to req.


const auth = (req, res, next) => {
  const token = req.header('Authorization')?.split(' ')[1];
  if (!token) return res.status(403).send("Access denied");

  try {
    const verified = jwt.verify(token, process.env.JWT_SECRET);
    req.user = verified;
    next();
  } catch {
    res.status(401).send("Invalid token");
  }
};

Protected Route

app.get('/dashboard', auth, (req, res) => {
  res.send(`Welcome user ${req.user.id}`);
});

3. MongoDB (Database)

You store user data like this:

const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  email: String,
  password: String, // hashed using bcrypt
  role: { type: String, default: "user" } // for authorization
});

const User = mongoose.model('User', userSchema);

🛂 Authorization (Role-Based Access)

Add another middleware to check roles:

const checkRole = (role) => (req, res, next) => {
  if (req.user.role !== role) return res.status(403).send("Forbidden");
  next();
};

app.get('/admin', auth, checkRole('admin'), (req, res) => {
  res.send("Welcome, Admin!");
});

✅ Best Practices

  • Always hash passwords before saving (bcrypt is the go-to).

  • Use httpOnly cookies for token storage if security is a concern (helps prevent XSS).

  • Set JWT expiration times and rotate/refresh tokens if needed.

  • Sanitize inputs to prevent injection attacks.

  • Protect all sensitive routes with both authentication and authorization.

Popular posts from this blog

How does BGP prevent routing loops? Explain AS_PATH and loop prevention mechanisms.

 In Border Gateway Protocol (BGP), preventing routing loops is critical — especially because BGP is the inter-domain routing protocol used to connect Autonomous Systems (ASes) on the internet. 🔄 How BGP Prevents Routing Loops The main mechanism BGP uses is the AS_PATH attribute . 🔍 What is AS_PATH? AS_PATH is a BGP path attribute that lists the sequence of Autonomous Systems (AS numbers) a route has traversed. Each time a route is advertised across an AS boundary, the local AS number is prepended to the AS_PATH. Example: If AS 65001 → AS 65002 → AS 65003 is the route a prefix has taken, the AS_PATH will look like: makefile AS_PATH: 65003 65002 65001 It’s prepended in reverse order — so the last AS is first . 🚫 Loop Prevention Using AS_PATH ✅ Core Mechanism: BGP routers reject any route advertisement that contains their own AS number in the AS_PATH. 🔁 Why It Works: If a route makes its way back to an AS that’s already in the AS_PATH , that AS kno...
Read more

Explain the Angular compilation process: View Engine vs. Ivy.

 The Angular compilation process transforms your Angular templates and components into efficient JavaScript code that the browser can execute. Over time, Angular has evolved from the View Engine compiler to a newer, more efficient system called Ivy . Here's a breakdown of the differences between View Engine and Ivy , and how each affects the compilation process: 🔧 1. What Is Angular Compilation? Angular templates ( HTML inside components) are not regular HTML—they include Angular-specific syntax like *ngIf , {{ }} interpolation, and custom directives. The compiler translates these templates into JavaScript instructions that render and update the DOM. Angular uses Ahead-of-Time (AOT) or Just-in-Time (JIT) compilation modes: JIT : Compiles in the browser at runtime (used in development). AOT : Compiles at build time into efficient JS (used in production). 🧱 2. View Engine (Legacy Compiler) ➤ Used in Angular versions < 9 🔍 How It Works: Compiles templat...
Read more

What is Zone.js, and why does Angular rely on it?

Zone.js is a library that Angular relies on to manage asynchronous operations and automatically trigger change detection when necessary. Think of it as a wrapper around JavaScript’s async APIs (like setTimeout , Promise , addEventListener , etc.) that helps Angular know when your app's state might have changed. 🔍 What is Zone.js? Zone.js creates an execution context called a "Zone" that persists across async tasks. It tracks when tasks are scheduled and completed—something JavaScript doesn't do natively. Without Zone.js, Angular wouldn’t automatically know when user interactions or async events (like an HTTP response) occur. You’d have to manually tell Angular to update the UI. ⚙️ Why Angular Uses Zone.js ✅ 1. Automatic Change Detection Zone.js lets Angular detect when an async task finishes and automatically run change detection to update the UI accordingly. Example: ts setTimeout ( () => { this . value = 'Updated!' ; // Angular know...
Read more