Visit https://authentication-app-473ad7.netlify.app.
This application/site was created as a submission to a DevChallenges challenge. The challenge was to build an application to complete the given user stories.
It features:
- Frontend deployed on Netlify; backend on Render
- Username/Password authentication
- Strong password policy enforcement
- Rate limit to account creation and profile edition
- OAuth authentication (GitHub and Google)
httpOnlycookies for session management- Client and server code are written in a modular and highly scalable way
- Profile images stored in Cloudinary
- Automatic dark mode
- Redis database for session storage
- Query and modify local Redis entries in real-time
Note: for the GitHub OAuth to work, third-party cookies must be enabled.
After grabbing a local copy of the repository, you can start the backend server in development or production mode, by issuing either npm run start:dev or npm run start respectively, from inside backend/ folder.
When using Redis database locally, the package redis-commander allows one to query and modify the entries in the database in real time.
Regarding the session, a secret must be provided to verify the authenticity of each user session (it's used to sign the session cookie).
The user data is stored in a Mongo database.
The application expects certain environment variables (provided values are template examples):
PORT=5000
MONGODB_URL="mongodb+srv://xxxxxxxxxxxxxxxxxxxxxxxx"
# Redis configuration only needed in development mode
REDIS_HOST="localhost"
REDIS_PORT=6379
# Secret for signing the session cookie
SESSION_SECRET="xxxxxxxxxxxxxxxxxxxxxxxx"
# OAuth
# GitHub
GITHUB_CLIENT_ID="xxxxxxxxxxxxxxxxxxxxxxxx"
GITHUB_CLIENT_SECRET="xxxxxxxxxxxxxxxxxxxxxxxx"
# Google
GOOGLE_CLIENT_ID="xxxxxxxxxxxxxxxxxxxxxxxx"
GOOGLE_CLIENT_SECRET="xxxxxxxxxxxxxxxxxxxxxxxx"
CLOUDINARY_URL="cloudinary://xxxxxxxxxxxxxxxxxxxxxxxx"
FRONTEND_URL="http://xxxxxxxxxxxxxxxxxxxxxxxx"It's recommended to set up two OAuth applications: one for testing and another for production. Also, environment variables may be set with values different as those of development.
For the rate limiter, a store more appropriate for production should be used (memory-store is currently used).