Explain how authentication and authorization work in a MERN stack application.

 Let's walk through authentication and authorization in a MERN stack application (MongoDB, Express.js, React, Node.js). These are critical for securing your app and controlling user access.

🔐 Authentication vs. Authorization

• Authentication: Proves who the user is (e.g., logging in).

• Authorization: Controls what that authenticated user can do (e.g., admin vs. regular user access).

⚙️ How It Works in the MERN Stack

1. React (Frontend)

• Users enter credentials via a login form.

• On submit, React sends a POST request to an Express.js backend.

• If the credentials are valid, the server returns a JWT (JSON Web Token).

• The JWT is stored client-side (e.g., localStorage, sessionStorage, or httpOnly cookies for better security).

• For all protected routes, React sends this JWT in the Authorization header of future requests.

2. Express.js + Node.js (Backend)

Login Endpoint

• Backend receives login credentials.

• Looks up the user in MongoDB.

• Compares hashed passwords using bcrypt.

• If valid, creates a JWT using jsonwebtoken and sends it back.

const jwt = require('jsonwebtoken');
const bcrypt = require('bcryptjs');

app.post('/login', async (req, res) => {
  const user = await User.findOne({ email: req.body.email });
  if (!user) return res.status(401).send("User not found");

  const isMatch = await bcrypt.compare(req.body.password, user.password);
  if (!isMatch) return res.status(401).send("Incorrect password");

  const token = jwt.sign({ id: user._id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' });
  res.json({ token });
});

Middleware to Protect Routes

• You create a middleware function to validate JWTs and attach user data to req.

const auth = (req, res, next) => {
  const token = req.header('Authorization')?.split(' ')[1];
  if (!token) return res.status(403).send("Access denied");

  try {
    const verified = jwt.verify(token, process.env.JWT_SECRET);
    req.user = verified;
    next();
  } catch {
    res.status(401).send("Invalid token");
  }
};

Protected Route

app.get('/dashboard', auth, (req, res) => {
  res.send(`Welcome user ${req.user.id}`);
});

3. MongoDB (Database)

You store user data like this:

const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  email: String,
  password: String, // hashed using bcrypt
  role: { type: String, default: "user" } // for authorization
});

const User = mongoose.model('User', userSchema);

🛂 Authorization (Role-Based Access)

Add another middleware to check roles:

const checkRole = (role) => (req, res, next) => {
  if (req.user.role !== role) return res.status(403).send("Forbidden");
  next();
};

app.get('/admin', auth, checkRole('admin'), (req, res) => {
  res.send("Welcome, Admin!");
});

✅ Best Practices

• Always hash passwords before saving (bcrypt is the go-to).

• Use httpOnly cookies for token storage if security is a concern (helps prevent XSS).

• Set JWT expiration times and rotate/refresh tokens if needed.

• Sanitize inputs to prevent injection attacks.

• Protect all sensitive routes with both authentication and authorization.