Authentication & Security
Node.js Authentication Overview
Authentication proves who a user is; authorisation decides what they may do. Node applications typically use either server-side sessions with a cookie, or stateless JSON Web Tokens.
What is Authentication Overview in Node.js?
Authentication proves who a user is; authorisation decides what they may do. Node applications typically use either server-side sessions with a cookie, or stateless JSON Web Tokens.
Key points to remember
- Never store passwords in plain text or with a fast hash — use bcrypt, argon2 or scrypt.
- Store tokens in httpOnly cookies rather than localStorage where possible.
- Authorisation must be checked on the server for every protected action.
- A refresh-token pair gives short-lived access tokens with the ability to revoke.
Sessions versus JWT
| Session + cookie | JWT | |
|---|---|---|
| State | stored on the server | stored by the client |
| Revocation | immediate — delete the session | hard — token is valid until it expires |
| Scaling | needs shared storage such as Redis | stateless, no shared store |
| Best for | traditional web apps, admin panels | APIs, mobile clients, service-to-service |
Node.js Authentication Overview— Interview Questions & FAQs
Should I use JWT or sessions?+
Sessions for a classic server-rendered application where instant logout matters. JWT for stateless APIs and mobile clients. A common middle ground is a short-lived JWT plus a revocable refresh token stored server-side.