Repository navigation
Authentication
The app supports two login methods. Both result in the same JWT-based session once authenticated.
When a user registers, their password is hashed using bcryptjs with 10 salt rounds before being saved to MongoDB. No plain-text passwords are stored.
When a user logs in, the backend finds the user by email, compares the submitted password against the stored hash, and if valid, signs a JWT token using the JWT_TOKEN secret. This token is returned to the frontend and stored in the auth context.
Google Sign-In is handled using Firebase Authentication on the frontend.
When the user clicks the Google button, Firebase opens a popup using signInWithPopup with a GoogleAuthProvider. After the user selects their account, Firebase returns a short-lived ID token.
The frontend sends this ID token to the backend via POST /api/auth/google. The backend verifies it using firebase-admin.auth().verifyIdToken(). If valid, it looks up or creates the user in MongoDB and issues a JWT — the same kind issued for email login. From this point the session is identical regardless of how the user signed in.
Every protected endpoint is wrapped with auth.middleware.js. The middleware extracts the JWT from the Authorization header, verifies it against the secret, and checks that it has not been blacklisted. If all checks pass, the decoded payload is attached to req.user and the request continues.
On the frontend, Protected.jsx wraps private routes and redirects unauthenticated users to the login page.
On logout, the current token is saved to a blackList collection in MongoDB. Any future request using that token will be rejected by the middleware even if the token itself has not expired yet. For Google users, auth.signOut() is also called on the Firebase client to clear the Google session.
To enable Google Sign-In:
- Go to Firebase Console and open your project.
- Navigate to Authentication, then Sign-in method, and enable Google.
- Under Project Settings, add a web app and copy the config values for the frontend
.env. - For production, go to Authentication, then Settings, then Authorized Domains, and add your Vercel domain. Without this, Google Sign-In will be blocked in production.