The application we have built uses JSON Web Token (https://jwt.io/) based authentication. Navigate to serverauthindex.ts and createJWToken, Authenticate and Authorize methods exported. createJWToken is used to create a new JWT token, taking in the user object as input.

The expiry time of the token is defined by TOKEN_MAXAGE that is defined in the .env file. Authenticate is an Express middleware, that processes the incoming request looking for the JWT token. Then this token is decoded and the user is fetched. Authorize is also an express middleware that authorizes whether a specific role user can access a specific type of API. For example, if we head over to server outesuser.ts and look at router.delete('/user/:id', Authenticate, Authorize('admin'), userCtrl.delete);, we can clearly see that a user who is trying to access the user delete API should be authenticated with a valid JWT and then authorized by being an admin. This way we protect our assets on the server side, even if client side validation fails.