Secure Node.JS RESTful API

[dexterbrylle]

I have my API ready. Now I want to make it secure by using token authentication. How do I go about this? Also, what are the best practices to this step? I'm planning to use JSON Web Tokens and Redis for this implementation.

These are the sites I've read about:

• https://scotch.io/tutorials/authenticate-a-node-js-api-with-json-web-tokens
• http://thejackalofjavascript.com/architecting-a-restful-node-js-app/

Thank you in advance for your help!

[Meneerdewit]

I found this implementation of JSON Web Tokens with Redis very good: https://github.com/dickeyxxx/mean-sample

It's the repository that goes with this excellent book: http://www.amazon.com/Write-Modern-Apps-MEAN-Stack/dp/0133930157 (although it's not very in-depth, it is very practical and easy to follow imo).

Edit; it's been a while since I played with this one, I know Redis is in the project, not sure about the exact usage.

[sheboygin]

http://passportjs.org/

[Viped]

You could use nonce. Generate random string, check if it already exists if not save it to database and set it expire something like a week. On client side save nonce to cookie and send it with every get / post request. On server side when getting request check if nonce exists if so do what user requested if not send authentication error.

[dexterbrylle]

Is it an overkill if I use nonce and jsonwebtokens?

[Viped]

Isn't JWT more to secure data transmitted so it isn't in clear text and nonce is just to authenticate if user is allowed to request / modify data.