← Node.js & Express learning pathNode.js & Express · Module 9 of 10
Authentication and security
Protect APIs with hashed passwords, JWTs and secure settings.
📖 Key ideas
- Hash passwords with bcrypt; never store plain text.
- JWT: sign a token on login, verify it on each request.
- Send tokens in the Authorization: Bearer header or httpOnly cookie.
- Use HTTPS, helmet, CORS rules and rate limits.
- Validate every input and keep dependencies updated.
💡 Real-life example: A JWT is a wristband at a concert: shown at each door, checked quickly without calling the box office.
bcryptPassword hashing library
JWTSigned token proving identity
Bearer tokenToken sent in Authorization header
httpOnly cookieCookie JavaScript cannot read