Authentication in Koa.js: Implementing JWT Authentication

In today’s web development landscape, securing your applications is non-negotiable. Let’s dive into implementing JWT (JSON Web Token) authentication in Koa.js, a lightweight and expressive Node.js web framework.

What is JWT Authentication?

JWT authentication provides a secure way to transmit information between parties as a JSON object. Think of it as a digital passport that proves the identity of your users. Each token is signed, making it tamper-proof and reliable.

Setting Up the Project

First, let’s set up our project with the necessary dependencies:

npm init -y
npm install koa @koa/router koa-bodyparser jsonwebtoken bcrypt

Implementing JWT Authentication

Here’s our basic authentication setup:

const Koa = require('koa');
const Router = require('@koa/router');
const bodyParser = require('koa-bodyparser');
const jwt = require('jsonwebtoken');

const app = new Koa();
const router = new Router();
const SECRET_KEY = 'your-secret-key';

app.use(bodyParser());

// Login endpoint
router.post('/login', async (ctx) => {
    const { username, password } = ctx.request.body;

    // Here you would typically validate against your database
    if (username === 'user' && password === 'password') {
        const token = jwt.sign({ username }, SECRET_KEY, { expiresIn: '1h' });
        ctx.body = { token };
    } else {
        ctx.status = 401;
        ctx.body = { error: 'Invalid credentials' };
    }
});

// Protected route middleware
const authMiddleware = async (ctx, next) => {
    try {
        const token = ctx.header.authorization.split(' ')[1];
        const decoded = jwt.verify(token, SECRET_KEY);
        ctx.state.user = decoded;
        await next();
    } catch (err) {
        ctx.status = 401;
        ctx.body = { error: 'Unauthorized' };
    }
};

// Protected route example
router.get('/protected', authMiddleware, async (ctx) => {
    ctx.body = { message: 'Access granted!', user: ctx.state.user };
});

app.use(router.routes()).use(router.allowedMethods());
app.listen(3000);

Best Practices for JWT Implementation

1. Secure Secret Key: Always use a strong, environment-variable-based secret key
2. Token Expiration: Set appropriate expiration times for your tokens
3. HTTPS: Always use HTTPS in production
4. Error Handling: Implement comprehensive error handling
5. Refresh Tokens: Consider implementing refresh tokens for better security

Testing the Authentication

Here’s how to test our endpoints using curl:

# Login
curl -X POST http://localhost:3000/login \
  -H "Content-Type: application/json" \
  -d '{"username": "user", "password": "password"}'

# Access protected route
curl http://localhost:3000/protected \
  -H "Authorization: Bearer <your-token-here>"

Remember to implement proper validation, error handling, and security measures in your production environment. JWT authentication is powerful but requires careful implementation to maintain security.