-2

There are many secured applications developed in node.js. However, I could not find any framework (like Spring-security in Java) that can be used to save the trouble of managing the authentication (login/logout).

Going further, there are many flows like create-account, forgot-password, change password etc. that each application developer has to develop by himself... What am I missing here? Is there such a framework that I am not familiar with?

I am not talking about UI form which are obviously application-specific, but I am talking about the logic itself which is mostly common to all apps.

If not, is it possible to design such a module?

Improve this question
6
  • 2
    Have a look at Oauth 2; for example, here.
    – Robert Harvey
    Mar 31, 2021 at 14:46
  • If you're referring to the actual UI, like a "Create Account" form and a "Forgot Password" form, those are properly part of your application, and therefore your responsibility to build. The reason this is the case is twofold: 1. There are many different UI technologies, and 2. There are many different UI designs. That's why there's no universal Contact form, Order form, etc.
    – Robert Harvey
    Mar 31, 2021 at 14:52
  • I am not talking about UI form which are obviously application-specific, but I am talking about the logic itself which is mostly common to all apps. (see edit)
    – OhadR
    Mar 31, 2021 at 16:43
  • Then see the link in my first comment above.
    – Robert Harvey
    Mar 31, 2021 at 16:49
  • i still do not understand why the down votes?
    – OhadR
    Mar 31, 2021 at 16:57

1 Answer 1

Reset to default
1

Long ago I have developed authentication-flows for Java over Spring, and recently I wrote authentication-flows-js.

It is a module that answers most flows - authentication, registration, forgot-password, change password etc., and it is secured enough so applications can use it without the fear that it will be easily hacked.

It is for node.js applications (written in TypeScript) that use express. It is an open source (in GitHub). A release version is on npm, so you can use it as a dependency in your package.json.

You can find here an example for a hosting application.

NOTE: I have heard comments like "It's not so difficult to implement". True. But you have to make sure you take care of all cases. For example, what happens if a user tries to create account that is already exists? what happens if a user tries to create account that is already exists but inactive? what about the policy of the password? (too long/too short/how many capital etc.) what about sending the email with the activation link to the user? how you create this link? should you encrypt it? what about the controller that will receive the click on the link and activate the account? and more...

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.