🔐 Authentication Service

A reusable, production-inspired authentication backend built with Node.js, Express.js, and PostgreSQL.

This service provides a complete authentication system that can be integrated into any web or mobile application. It follows a layered architecture and implements secure authentication using JWT, HTTP-only cookies, hashed refresh tokens, email verification, password reset, and PostgreSQL-backed session management.

Purpose: Build once, reuse across multiple projects.

---

🚀 Overview

This project is designed as a standalone authentication service that can be integrated into any frontend or backend application.

Instead of implementing authentication from scratch for every project, simply connect your application to this REST API.

It handles:

• User Registration
• User Login
• User Logout
• Email Verification
• Forgot Password
• Password Reset
• User Profile
• Protected Routes
• JWT Authentication
• Session Management
• Automatic Cleanup of Expired Tokens

Compatible with:

• React.js
• Next.js
• Vue.js
• Angular
• React Native
• Flutter
• MERN Stack
• PERN Stack
• Mobile Applications
• Microservices

---

✨ Features

🔑 Authentication

• ✅ User Registration
• ✅ User Login
• ✅ User Logout
• ✅ Get Current User Profile
• ✅ Protected Routes
• ✅ JWT Access Token Authentication
• ✅ JWT Refresh Token Authentication

---

🔒 Security

• ✅ Password Hashing with bcrypt
• ✅ HTTP-only Cookie Authentication
• ✅ Secure Cookie Configuration
• ✅ Refresh Token Hashing using Crypto
• ✅ Refresh Token Revocation
• ✅ SQL Injection Protection (Parameterized Queries)
• ✅ Environment Variable Configuration

---

👤 Account Management

• ✅ Email Verification
• ✅ Forgot Password
• ✅ Password Reset
• ✅ Verification Token Expiration
• ✅ Password Reset Token Expiration

---

📧 Email Services

• ✅ Verification Email
• ✅ Password Reset Email
• ✅ HTML Email Templates
• ✅ Nodemailer Integration

---

⚙️ Background Jobs

• ✅ Automatic Cleanup of Expired Refresh Tokens
• ✅ Automatic Cleanup of Expired Verification Tokens
• ✅ Automatic Cleanup of Expired Password Reset Tokens
• ✅ Scheduled Jobs using node-cron

---

🏗 Architecture

• ✅ RESTful API
• ✅ Layered Architecture (Controller → Service → Database)
• ✅ Modular Project Structure
• ✅ PostgreSQL Database
• ✅ Express.js Middleware
• ✅ Reusable Authentication Module

---

🔄 Authentication Flow

Register
    │
    ▼
Hash Password
    │
    ▼
Create User
    │
    ▼
Generate Verification Token
    │
    ▼
Send Verification Email
    │
    ▼
Verify Email
    │
    ▼
Login
    │
    ▼
Verify Password
    │
    ▼
Generate Access Token
Generate Refresh Token
    │
    ▼
Hash Refresh Token
    │
    ▼
Store Session
    │
    ▼
HTTP-only Cookies
    │
    ▼
Protected Routes
    │
    ▼
Logout
    │
    ▼
Delete Refresh Token

---

🔌 Using This Authentication Service

This project runs as an independent authentication server.

1. Clone the Repository

git clone https://github.com/<your-username>/authentication-service.git

cd authentication-service

---

2. Install Dependencies

npm install

---

3. Configure Environment Variables

Create a .env file.

PORT=5000

DB_HOST=localhost
DB_PORT=5432
DB_NAME=your_database
DB_USER=postgres
DB_PASSWORD=your_password

JWT_ACCESS_SECRET=your_access_secret
JWT_REFRESH_SECRET=your_refresh_secret

EMAIL_USER=your_email@example.com
EMAIL_PASS=your_email_password
CLIENT_URL=http://localhost:3000

---

4. Configure PostgreSQL

Create the required database and tables.

Run your SQL schema before starting the server.

---

5. Start the Server

Development

npm run dev

Production

npm start

Server runs on

http://localhost:5000

---

6. Connect Your Frontend

Your frontend only needs to call the REST API.

Example endpoints:

POST /api/auth/register

POST /api/auth/login

POST /api/auth/logout

GET /api/auth/profile

POST /api/auth/forgot-password

POST /api/auth/reset-password

GET /api/auth/verify-email

When using Fetch API:

fetch(url, {
    method: "POST",
    credentials: "include"
});

When using Axios:

axios.defaults.withCredentials = true;

Cookies will be automatically sent with every authenticated request.

---

📂 Project Structure

src/
│
├── config/
│   └── db_config.js
│
├── controllers/
│
├── services/
│
├── routes/
│
├── middleware/
│
├── templates/
│
├── utils/
│
├── cron/
│
└── server.js