🔐 Authentication System (From Scratch)

📌 Overview

In this project, we implemented and understood different authentication mechanisms from first principles using Node.js, Express, and middleware.

We explored how identity is verified between a client and server, and how different approaches handle authentication.

---

🧠 What We Learned

1. Basic Authentication

• Credentials (username & password) are sent in every request.
• Encoded in Base64 and passed via the Authorization header.
• Server decodes and validates the user on each request.

👉 Problem: Not secure and inefficient (credentials sent repeatedly)

---

2. Session-Based Authentication

• Server creates a session after successful login.
• A session ID is sent to the client via cookies (connect.sid).
• Browser automatically sends this cookie in future requests.
• Server verifies session and grants access.

Features Implemented:

• /session/login → creates session
• /session/check → protected route
• /session/logout → destroys session and clears cookie

👉 Insight: Server stores user state (stateful)

---

3. JWT (Token-Based Authentication)

• Server generates a token after login using jsonwebtoken.
• Token is sent to client and stored (usually in localStorage or memory).
• Client sends token in Authorization header for each request.
• Server verifies token without storing session data.

Features Implemented:

• /jwt/login → generates token
• /jwt/check → verifies token using jwt.verify()

👉 Insight: Stateless authentication (no server memory)

---

⚖️ Key Differences

Feature	Session Auth	JWT Auth
Storage	Server	Client
State	Stateful	Stateless
Logout	Server destroys session	Client removes token
Scalability	Limited	High

---

🚀 Key Takeaways

• Authentication is about proving identity.
• Sessions = server remembers you.
• JWT = you prove yourself every time.
• Logout behavior differs based on architecture.
• Understanding flow > memorizing code.

---

🛠 Tech Stack

• Node.js
• Express.js
• express-session
• jsonwebtoken
• morgan (logging)

---

📁 Reference

Code implementation: :contentReference[oaicite:0]{index=0}