secure-web-token

import express from "express"; import cookieParser from "cookie-parser"; import { sign, verify, getStore } from "secure-web-token"; const app = express(); app.use(express.json()); app.use(cookieParser()); const SECRET = process.env.SWT_SECRET ?? 'a-very-secure-random-secret-key-of-at-least-32-characters'; // Use environment variable for production const store = getStore("memory"); // Default in-memory store, replace with persistent for production // Define a simple user for demonstration const demoUser = { userId: 123, username: "testuser" }; // --- Sign Token Example --- app.post('/login', (req, res) => { // In a real app, validate user credentials here const { token, sessionId } = sign(demoUser, SECRET, { fingerprint: true, // Enable device binding store: "memory", // Use the configured store expiresIn: 3600 // Token expires in 1 hour }); // Set HttpOnly cookie for sessionId res.cookie("swt_session", sessionId, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' }); res.json({ message: "Login successful", token }); }); // --- Verify Token Example --- app.get('/protected', (req, res) => { try { const sessionId = req.cookies.swt_session; const token = req.headers.authorization?.split(" ")[1]; if (!sessionId || !token) { return res.status(401).json({ error: "Authentication required" }); } // Retrieve session data (e.g., fingerprint) from the store const session = store.getSession(sessionId); if (!session) { return res.status(401).json({ error: "Session not found or expired" }); } const payload = verify(token, SECRET, { sessionId, fingerprint: session.fingerprint, // Crucial for device binding store: "memory" // Use the configured store }); res.json({ message: "Access granted!", user: payload.data }); } catch (error) { console.error("Verification failed:", error); res.status(401).json({ error: "Unauthorized access" }); } }); const PORT = 3000; app.listen(PORT, () => { console.log(`Server running on http://localhost:${PORT}`); console.log("Try: POST /login and then GET /protected with the token and cookie."); });