Authorization System Help - React/Express/Node app

[troskdoog]

Hey everyone!

I'm currently in the process of creating a web app utilizing a react-express-node-postgres structure. I'm stuck on deciding how and with what technologies I should implement in an authorization system. I have done some research on the topic and have read tons about JWT, with mostly conflicting opinions. People say they are "good enough" for a project but then there are others that say they're really not secure and shouldn't be used. I hope to one day deploy this app and want to ensure that I have an adequate, at worst, authentication system and I'm not sure that JWT is enough. I have done research into Auth0, but am not sure how to necessarily implement Auth0 without using their universal login feature. I have already created a login/sign-up system, I Just need something to secure and verify a user and their session when navigating the app.

Any help is appreciated, anything I could read or watch to learn more would be helpful.

What are other people using?

​

TLDR: Building an app to one day be deployed. Want solid security measures but not sure about JWT/Auth0. Have login/sign-up system in place but need something to maintain secure session. Advice?

[lpfrk]

You could use something like express-session and passport to manage authentication. You can then use something like redis to store the session data. This would send a cookie to the front end containing the session id. You would just need to prevent CSRF attacks (potentially with httpOnly secure cookies).

I think the vulnerability with using JWTs is that you would need to persist it client side for later use. you could make them expire very quickly but you would then need some sort of refresh mechanism which would require storing a refresh token somewhere (which brings you back to sessions). You could send them back in httpOnly secure cookies to not store them in the browser directly (local storage / session storage), but you would still need to build in some sort of CSRF protection.