Basic authentication and passing token to next endpoint - node.js

Question

I am new to basic authentication and tokens.
I have been playing around with postman in order to get a token using basic authentication and then passing the token as a bearer token to access another endpoint. I wanted to know how I would code this into api calls using node and express.
I know that for Basic auth I need to encode the client id and secret into base64
curl --request POST \
--url http://localhost:8080/token/ \
--header 'authorization: Basic ***' \
--header 'content-type: application/x-www-form-urlencoded' \
--data
grant_type=credentials
The token I get from the above call I want to pass onto the below call
curl --request POST \
--url http://localhost:8080/login \
--header 'authorization: Bearer ***' \
--header 'content-type: application/x-www-form-urlencoded' \
--data
user=1
How would this like as code in a node application

Answer 1

I would recommend json web token aka jwt for this purpose.
Right now I code REST API in express, mongodb, and I am using jwt for auth.
Since I dont use any frontend framework or lib, I use cookie for jwt token storage.
const jwt = require('jsonwebtoken');
const generateToken = (res, id, auth_level) => {
const token = jwt.sign({id,
auth_level
}, process.env.JWT_KEY, {
expiresIn: '7d'
});
return res.cookie('token', token, {
expires: new Date(Date.now() + 1000 * 60 * 15),
secure: false,
httpOnly: true,
});
};
module.exports = generateToken
In this example I call this function on sucessful login try. And after that on every route access, using middleware I try to resolve if user have this token and try to resolve token.
const jwt = require('jsonwebtoken');
// Verify user token from cookie
const verifyToken = async (req, res, next) => {
// Get token from cookie named token
const token = req.cookies.token || '';
try {
// Check if cookie exists, maybe expired maybe user didnt have one - no login
if (!token) {
return next();
}
// Decrypt users jwt token and get information
const decrypt = await jwt.verify(token, process.env.JWT_KEY);
// Pass that infomation to request user object
req.user = {
id: decrypt.id,
auth_level: decrypt.auth_level,
test: 'test'
};
// Continue with exectution of app
return next();
} catch (err) {
return res.status(500).json(err.toString());
}
};
module.exports = verifyToken;
If this token is valid, I pass custom user object to req object.
After this I protect routes with custom middlewares. Code is inspired by this tutorial, would recommend it.