{"id":113140,"date":"2022-03-21T11:00:00","date_gmt":"2022-03-21T09:00:00","guid":{"rendered":"https:\/\/www.javacodegeeks.com\/?p=113140"},"modified":"2022-03-16T15:04:07","modified_gmt":"2022-03-16T13:04:07","slug":"securing-restful-apis-with-nodejs-and-express","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html","title":{"rendered":"Securing Restful APIs with Nodejs and Express"},"content":{"rendered":"

Hello. In this tutorial, we will understand how to secure restful apis in a nodejs with the help of the json web token.<\/p>\n

1. Introduction<\/h2>\n

To protect the restful apis in a nodejs application once usually recommends the most common approach known as the json web token (popularly called the \u201cjwt\u201d or \u201cjot\u201d). Json web tokens (or jwt) are an open standard that provides a secure way to set up communication between the two parties. It includes a header, payload, and signature separated by a dot. Jwt tokens are usually when there is a need to maintain a stateless communication between the server and client. The below picture presents a simple jwt token \u2013<\/p>\n

\n
\"\"<\/a>
Fig. 1: Jwt token<\/figcaption><\/figure>\n<\/div>\n

Any jwt can be read by pasting the given token on this website<\/a>.<\/p>\n

1.1 Setting up Node.js<\/h3>\n

To set up Node.js<\/strong> on windows you will need to download the installer from this<\/a> link. Click on the installer (also include the NPM package manager) for your platform and run the installer to start with the Node.js setup wizard. Follow the wizard steps and click on Finish when it is done. If everything goes well you can navigate to the command prompt to verify if the installation was successful as shown in Fig. 1.<\/p>\n

\n
\"\"<\/a>
Fig. 2: Verifying node and npm installation<\/figcaption><\/figure>\n<\/div>\n

2. Securing Restful APIs with Nodejs and Express<\/h2>\n

To set up the application, we will need to navigate to a path where our project will reside and I will be using Visual Studio Code<\/a> as my preferred IDE.<\/p>\n

Let us take a look at the code structure.<\/p>\n

\n
\"\"<\/a>
Fig. 3: Application code structure<\/figcaption><\/figure>\n<\/div>\n

2.1 Setting up dependencies<\/h3>\n

Navigate to the project directory and run npm init -y<\/code> to create a package.json<\/code> file. This file<\/a> holds the metadata relevant to the project and is used for managing the project dependencies, script, version, etc. Replace the generated file with the code given below –<\/p>\n

package.json<\/em><\/span><\/p>\n

{\n  \"name\": \"secure-rest-apis\",\n  \"version\": \"1.0.0\",\n  \"description\": \"how to secure rest apis in express\",\n  \"main\": \"index.js\",\n  \"scripts\": {\n    \"start\": \"node index.js\",\n    \"dev\": \"nodemon index.js\",\n    \"test\": \"echo \\\"Error: no test specified\\\" && exit 1\"\n  },\n  \"keywords\": [\n    \"restful apis\",\n    \"jwt\",\n    \"express\",\n    \"nodejs\",\n    \"nodemon\",\n    \"bcrypt\",\n    \"jsonwebtoken\"\n  ],\n  \"author\": \"geeks\",\n  \"license\": \"MIT\",\n  \"dependencies\": {\n    \"bcrypt\": \"^5.0.1\",\n    \"express\": \"^4.17.3\",\n    \"jsonwebtoken\": \"^8.5.1\"\n  },\n  \"devDependencies\": {\n    \"nodemon\": \"^2.0.15\"\n  }\n}\n<\/pre>\n
2.2 Setting up middleware for the application<\/h3>\n
The middleware<\/code> folder is responsible for two items i.e. validation of the authentication token and roles sent to the \/api\/messages<\/code> endpoint.
 
<\/div> <\/div><\/p>\n
<\/a>2.2.1 Validation of authentication token<\/h4>\n
This file is responsible to validate the token passed in the request to fetch the data. The function will fetch the token from the request header, validate it, and throw the required exception (if any).<\/p>\n
auth.js<\/em><\/span><\/p>\n
const jwt = require(\"jsonwebtoken\");\n\nmodule.exports = (req, res, next) => {\n  const auth_token = req.header(\"x-auth-token\");\n  if (!auth_token)\n    return res.status(401).send({\n      status: \"unauthorized\",\n      code: 401,\n      error: \"No auth token provided\"\n    });\n\n  try {\n    const decoded = jwt.verify(auth_token, \"jwtPrivateKey\");\n    req.user = decoded;\n  } catch (error) {\n    return res.status(401).send({\n      status: \"unauthorized\",\n      code: 401,\n      error: \"Token expired\"\n    });\n  }\n\n  next();\n};\n<\/pre>\n
<\/a>2.2.2 Validation of roles in the authentication token<\/h4>\n
This file is responsible to validate the presence of user roles in the token. These roles will be added to the authentication token after successful credentials validation.<\/p>\n
roles.js<\/em><\/span><\/p>\n
const msg = \"Access denied\";\nconst forbidden = \"forbidden\";\nconst s_code = 403;\n\nfunction admin(req, res, next) {\n  if (!req.user.roles.includes(\"admin\"))\n    return res.status(403).send({\n      status: forbidden,\n      code: s_code,\n      error: msg\n    });\n\n  next();\n}\n\nfunction editor(req, res, next) {\n  if (!req.user.roles.includes(\"editor\"))\n    return res.status(403).send({\n      status: forbidden,\n      code: s_code,\n      error: msg\n    });\n\n  next();\n}\n\nfunction viewer(req, res, next) {\n  if (!req.user.roles.includes(\"viewer\"))\n    return res.status(403).send({\n      status: forbidden,\n      code: s_code,\n      error: msg\n    });\n\n  next();\n}\n\n\/\/ export router\nmodule.exports = { admin, editor, viewer };\n<\/pre>\n
2.3 Setting up application routes<\/h3>\n
The routes<\/code> folder is responsible to define the application routes.<\/p>\n
2.3.1 Creating token endpoint<\/h4>\n
This file is responsible for validating user credentials and creating a jwt token. The database authentication is omitted from the scope of the tutorial and hence we will use a mock authentication object but you\u2019re free to update the code as per your wish.<\/p>\n
token.js<\/em><\/span><\/p>\n
const express = require(\"express\");\nconst jwt = require(\"jsonwebtoken\");\nconst bcrypt = require(\"bcrypt\");\n\n\/\/ setting up express server router\nconst router = express.Router();\n\n\/\/ user authentication\n\n\/\/ http post - http:\/\/localhost:3005\/api\/token\n\/*\n{\n    \"email\": \"abc@example.com\",\n    \"password\": \"P@ssword01!\"\n}\n*\/\nrouter.post(\"\/\", async (req, res) => {\n  \/\/ mock data\n  const users = [\n    {\n      email: \"abc@example.com\",\n      password: \"$2b$15$U9UK8N.m5uWbletbMwKlHuYRxXRY5j\/cbaWmtK9TAxSncFgk5vdQu\", \/\/ P@ssword01!\n      roles: [\"admin\", \"editor\", \"viewer\"]\n    }\n  ];\n\n  \/\/ get user from db and if not found throw error\n  let user = users.find((u) => req.body.email == u.email);\n  if (!user) throw new Error(\"Invalid user\");\n\n  \/\/ compare password with password from the db\n  const valid = await bcrypt.compare(req.body.password, user.password);\n  if (!valid) throw new Error(\"Invalid password\");\n\n  const tkn = jwt.sign(\n    {\n      id: user.id,\n      roles: user.roles\n    },\n    \"jwtPrivateKey\",\n    { expiresIn: \"15m\" }\n  );\n\n  res.status(200).send({\n    status: \"ok\",\n    code: 200,\n    token: tkn\n  });\n});\n\n\/\/ export router\nmodule.exports = router;\n<\/pre>\n
2.3.2 Creating the messages endpoint<\/h4>\n
This file is responsible for exposing the endpoints that a user can play with. Each endpoint is protected with authentication and authorization.
The auth<\/code> keyword represents the authentication mechanism set by the auth.js<\/a> while the admin<\/code> or editor<\/code> or viewer<\/code> keywords represent the authorization mechanism set by the roles.js<\/a>.<\/p>\n
messages.js<\/em><\/span><\/p>\n
const express = require(\"express\");\nconst auth = require(\"..\/middleware\/auth\");\nconst { admin, editor, viewer } = require(\"..\/middleware\/roles\");\n\n\/\/ setting up express server router\nconst router = express.Router();\n\n\/\/ mock data\nlet messages = [\n  {\n    id: 1,\n    name: \"Lorem ipsum dolor\"\n  }\n];\n\n\/\/ messages routes\n\/\/ each request must have an x-auth-token request header containing a valid access token\n\n\/\/ http get - http:\/\/localhost:3005\/api\/messages\nrouter.get(\"\/\", [auth, viewer], (req, res) => {\n  res.status(200).send({\n    status: \"ok\",\n    code: 200,\n    result: messages\n  });\n});\n\n\/\/ http post - http:\/\/localhost:3005\/api\/messages\n\/*\n{\n    \"name\": \"Some random name\"\n}\n*\/\nrouter.post(\"\/\", [auth, editor], async (req, res) => {\n  messages.push({ id: messages.length + 1, name: req.body.name });\n  res.status(201).send({\n    status: \"created\",\n    code: 201\n  });\n});\n\n\/\/ http delete - http:\/\/localhost:3005\/api\/messages?key=1\nrouter.delete(\"\/\", [auth, admin], async (req, res) => {\n  const idToRemove = req.query.key;\n  messages = messages.filter(function (item) {\n    return item.id != idToRemove;\n  });\n\n  res.status(202).send({\n    status: \"accepted\",\n    code: 202\n  });\n});\n\n\/\/ Todo - implement put\n\n\/\/ export router\nmodule.exports = router;\n<\/pre>\n
2.4 Setting up implementation file<\/h3>\n
This file describes the main implementation (i.e. the driver code).<\/p>\n
index.js<\/em><\/span><\/p>\n
const express = require(\"express\");\n\n\/\/ setting up express server\nconst app = express();\napp.use(express.json());\n\nconst token = require(\".\/routes\/token\");\nconst messages = require(\".\/routes\/messages\");\n\n\/\/ application routes\napp.use(\"\/api\/token\", token);\napp.use(\"\/api\/messages\", messages);\n\n\/\/ driver code\nconst SERVER_PORT = 3005;\napp.listen(SERVER_PORT, () => {\n  console.log(`Service endpoint = http:\/\/localhost:${SERVER_PORT}`);\n});\n<\/pre>\n
3. Run the Application<\/h2>\n
To run the application navigate to the project directory and enter the following command as shown below in the terminal.<\/p>\n
Run command<\/em><\/span><\/p>\n
$ npm run dev\n<\/pre>\n
If everything goes well the application will be started successfully at the service endpoint – http:\/\/localhost:3005<\/code><\/p>\n
4. Application endpoints<\/h2>\n
The application exposes the below endpoints that you can explore around the application with the help of the postman<\/a> tool. You can also download the postman collection from the Downloads<\/a> section and import it into the tool for an easy setup.<\/p>\n
Application endpoints<\/em><\/span><\/p>\n
\/\/ user authentication\n\/\/ http post - http:\/\/localhost:3005\/api\/token\n\/*\n{\n    \"email\": \"abc@example.com\",\n    \"password\": \"P@ssword01!\"\n}\n*\/\n\n\/\/ application endpoints\n\/\/ each request must have an \"x-auth-token\" request header containing a valid access token\n\n\/\/ http get - http:\/\/localhost:3005\/api\/messages\n\n\/\/ http post - http:\/\/localhost:3005\/api\/messages\n\/*\n{\n    \"name\": \"Some random name\"\n}\n*\/\n\n\/\/ http delete - http:\/\/localhost:3005\/api\/messages?key=1\n<\/pre>\n
That is all for this tutorial and I hope the article served you with whatever you were looking for. Happy Learning and do not forget to share!<\/p>\n
5. Summary<\/h2>\n
In this tutorial, we saw the implementation of securing the restful apis using the JSON web token (jwt). You can download the source code from the Downloads<\/a> section.<\/p>\n
<\/a>6. Download the Project<\/h2>\n
This was a tutorial to secure the restful apis in a nodejs and express application.<\/p>\n
Download<\/strong>
You can download the full source code of this example here: Securing Restful APIs with Nodejs and Express<\/strong><\/a><\/div>\n","protected":false},"excerpt":{"rendered":"
Hello. In this tutorial, we will understand how to secure restful apis in a nodejs with the help of the json web token. 1. Introduction To protect the restful apis in a nodejs application once usually recommends the most common approach known as the json web token (popularly called the \u201cjwt\u201d or \u201cjot\u201d). Json web …<\/p>\n","protected":false},"author":26931,"featured_media":20900,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1879],"tags":[991,1289,1712,741],"class_list":["post-113140","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-javascript","tag-express-js","tag-jwt","tag-jwt-authentication","tag-node-js"],"yoast_head":"\nSecuring Restful APIs with Nodejs and Express - Java Code Geeks<\/title>\n<meta name=\"description\" content=\"Hello. In this tutorial, we will understand how to secure restful apis in a nodejs with the help of the json web token. 1. Introduction To protect the\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Securing Restful APIs with Nodejs and Express - Java Code Geeks\" \/>\n<meta property=\"og:description\" content=\"Hello. In this tutorial, we will understand how to secure restful apis in a nodejs with the help of the json web token. 1. Introduction To protect the\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html\" \/>\n<meta property=\"og:site_name\" content=\"Java Code Geeks\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/javacodegeeks\" \/>\n<meta property=\"article:published_time\" content=\"2022-03-21T09:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2014\/01\/javascript-logo.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"150\" \/>\n\t<meta property=\"og:image:height\" content=\"150\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Yatin Batra\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@javacodegeeks\" \/>\n<meta name=\"twitter:site\" content=\"@javacodegeeks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Yatin Batra\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html\"},\"author\":{\"name\":\"Yatin Batra\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/person\\\/cda31a4c1965373fed40c8907dc09b8d\"},\"headline\":\"Securing Restful APIs with Nodejs and Express\",\"datePublished\":\"2022-03-21T09:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html\"},\"wordCount\":731,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2014\\\/01\\\/javascript-logo.jpg\",\"keywords\":[\"Express.js\",\"JWT\",\"JWT Authentication\",\"Node.js\"],\"articleSection\":[\"JavaScript\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html\",\"name\":\"Securing Restful APIs with Nodejs and Express - Java Code Geeks\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2014\\\/01\\\/javascript-logo.jpg\",\"datePublished\":\"2022-03-21T09:00:00+00:00\",\"description\":\"Hello. In this tutorial, we will understand how to secure restful apis in a nodejs with the help of the json web token. 1. Introduction To protect the\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html#primaryimage\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2014\\\/01\\\/javascript-logo.jpg\",\"contentUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2014\\\/01\\\/javascript-logo.jpg\",\"width\":150,\"height\":150},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/securing-restful-apis-with-nodejs-and-express.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Web Development\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/category\\\/web-development\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"JavaScript\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/category\\\/web-development\\\/javascript\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Securing Restful APIs with Nodejs and Express\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#website\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\",\"name\":\"Java Code Geeks\",\"description\":\"Java Developers Resource Center\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\"},\"alternateName\":\"JCG\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.javacodegeeks.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\",\"name\":\"Exelixis Media P.C.\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/exelixis-logo.png\",\"contentUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/exelixis-logo.png\",\"width\":864,\"height\":246,\"caption\":\"Exelixis Media P.C.\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/javacodegeeks\",\"https:\\\/\\\/x.com\\\/javacodegeeks\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/person\\\/cda31a4c1965373fed40c8907dc09b8d\",\"name\":\"Yatin Batra\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/12\\\/Yatin.batra_.jpg\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/12\\\/Yatin.batra_.jpg\",\"contentUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/12\\\/Yatin.batra_.jpg\",\"caption\":\"Yatin Batra\"},\"description\":\"An experience full-stack engineer well versed with Core Java, Spring\\\/Springboot, MVC, Security, AOP, Frontend (Angular & React), and cloud technologies (such as AWS, GCP, Jenkins, Docker, K8).\",\"sameAs\":[\"https:\\\/\\\/www.javacodegeeks.com\"],\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/author\\\/yatin-batra\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Securing Restful APIs with Nodejs and Express - Java Code Geeks","description":"Hello. In this tutorial, we will understand how to secure restful apis in a nodejs with the help of the json web token. 1. Introduction To protect the","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html","og_locale":"en_US","og_type":"article","og_title":"Securing Restful APIs with Nodejs and Express - Java Code Geeks","og_description":"Hello. In this tutorial, we will understand how to secure restful apis in a nodejs with the help of the json web token. 1. Introduction To protect the","og_url":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html","og_site_name":"Java Code Geeks","article_publisher":"https:\/\/www.facebook.com\/javacodegeeks","article_published_time":"2022-03-21T09:00:00+00:00","og_image":[{"width":150,"height":150,"url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2014\/01\/javascript-logo.jpg","type":"image\/jpeg"}],"author":"Yatin Batra","twitter_card":"summary_large_image","twitter_creator":"@javacodegeeks","twitter_site":"@javacodegeeks","twitter_misc":{"Written by":"Yatin Batra","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html#article","isPartOf":{"@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html"},"author":{"name":"Yatin Batra","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/person\/cda31a4c1965373fed40c8907dc09b8d"},"headline":"Securing Restful APIs with Nodejs and Express","datePublished":"2022-03-21T09:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html"},"wordCount":731,"commentCount":0,"publisher":{"@id":"https:\/\/www.javacodegeeks.com\/#organization"},"image":{"@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html#primaryimage"},"thumbnailUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2014\/01\/javascript-logo.jpg","keywords":["Express.js","JWT","JWT Authentication","Node.js"],"articleSection":["JavaScript"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html","url":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html","name":"Securing Restful APIs with Nodejs and Express - Java Code Geeks","isPartOf":{"@id":"https:\/\/www.javacodegeeks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html#primaryimage"},"image":{"@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html#primaryimage"},"thumbnailUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2014\/01\/javascript-logo.jpg","datePublished":"2022-03-21T09:00:00+00:00","description":"Hello. In this tutorial, we will understand how to secure restful apis in a nodejs with the help of the json web token. 1. Introduction To protect the","breadcrumb":{"@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html#primaryimage","url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2014\/01\/javascript-logo.jpg","contentUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2014\/01\/javascript-logo.jpg","width":150,"height":150},{"@type":"BreadcrumbList","@id":"https:\/\/www.javacodegeeks.com\/securing-restful-apis-with-nodejs-and-express.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.javacodegeeks.com\/"},{"@type":"ListItem","position":2,"name":"Web Development","item":"https:\/\/www.javacodegeeks.com\/category\/web-development"},{"@type":"ListItem","position":3,"name":"JavaScript","item":"https:\/\/www.javacodegeeks.com\/category\/web-development\/javascript"},{"@type":"ListItem","position":4,"name":"Securing Restful APIs with Nodejs and Express"}]},{"@type":"WebSite","@id":"https:\/\/www.javacodegeeks.com\/#website","url":"https:\/\/www.javacodegeeks.com\/","name":"Java Code Geeks","description":"Java Developers Resource Center","publisher":{"@id":"https:\/\/www.javacodegeeks.com\/#organization"},"alternateName":"JCG","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.javacodegeeks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.javacodegeeks.com\/#organization","name":"Exelixis Media P.C.","url":"https:\/\/www.javacodegeeks.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/06\/exelixis-logo.png","contentUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/06\/exelixis-logo.png","width":864,"height":246,"caption":"Exelixis Media P.C."},"image":{"@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/javacodegeeks","https:\/\/x.com\/javacodegeeks"]},{"@type":"Person","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/person\/cda31a4c1965373fed40c8907dc09b8d","name":"Yatin Batra","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/12\/Yatin.batra_.jpg","url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/12\/Yatin.batra_.jpg","contentUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/12\/Yatin.batra_.jpg","caption":"Yatin Batra"},"description":"An experience full-stack engineer well versed with Core Java, Spring\/Springboot, MVC, Security, AOP, Frontend (Angular & React), and cloud technologies (such as AWS, GCP, Jenkins, Docker, K8).","sameAs":["https:\/\/www.javacodegeeks.com"],"url":"https:\/\/www.javacodegeeks.com\/author\/yatin-batra"}]}},"_links":{"self":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts\/113140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/users\/26931"}],"replies":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/comments?post=113140"}],"version-history":[{"count":0,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts\/113140\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/media\/20900"}],"wp:attachment":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/media?parent=113140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/categories?post=113140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/tags?post=113140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}