Securing Node.js APIs with JSON Web Tokens (JWT)

In the world of modern web development, keeping user data safe is non-negotiable. For Node.js developers, JSON Web Tokens (JWT) have become the industry standard for stateless authentication.

What is a JWT?

A JWT is an encoded string that can be used to pass information between a client and a server. Unlike traditional sessions, the server doesn’t need to store a “session ID” in a database. Everything the server needs to know is stored inside the token itself.

The Three Parts of a JWT

Every token consists of three parts separated by dots:

• Header: Specifies the algorithm (like HS256).
• Payload: Contains the user data (user ID, username).
• Signature: The security layer that proves the token hasn’t been tampered with.

Implementation in Express.js

To get started, you’ll need to install the library: npm install jsonwebtoken. Here is a basic look at how we sign a token during login:

const jwt = require('jsonwebtoken');

// Generate a token
const token = jwt.sign(
    { userId: user._id }, 
    process.env.JWT_SECRET, 
    { expiresIn: '1h' }
);

Best Practices for Security

Always use HTTPS when transmitting tokens to prevent “Man-in-the-Middle” attacks. Additionally, store your JWT_SECRET in a secure .env file—never hardcode it in your scripts.

Conclusion

Implementing JWT is a huge step toward building professional, scalable backends. It allows your API to remain stateless, making it much easier to scale horizontally across multiple servers.