Using Express middleware for authentication

For the longest time, my bot platform was secured by a simple hard-coded password check on the client-side. This was OK for a placeholder, but isn't security by any means. In the recent rewrite, I implemented a solution using JSON Web Tokens within Express.

In the new version of my platform, we assume there to only be one user. We also assume that this user will host an instance of the platform themselves, so security is strictly "Am I logged in or not" - We do not need to worry about users attempting to access resources belonging to other users.

We allow multiple modules bound to a context object. These modules are all exported as:

export {default as account} from './account' // Provides general account functionality
export {default as alerts} from './alerts' // Pushes alerts to webapp and mobile app
export {default as auth} from './auth' // Provides authentication endpoints
export {default as exchange} from './exchange' // Provides exchange data feed
export {default as repl} from './repl' // REPL scripting server-side
export {default as scripts} from './scripts' // User scripts running server-side
export {default as wallet} from './wallet' // Provides wallet management

In our primary Express app, we can import these modules:

import * as base_modules from './modules'
import auth from './modules/auth/api.js'

And then gracefully mount them:

// Mount public modules
app.use('/auth', auth);

// Ensure valid credentials for rest of API
app.use(function(req, res, next) {
  let jwtobj = req[jwt.options.reqProperty];
  
  // Validate session
  if(jwtobj && jwtobj.payload['session'] && config.get('sessions').indexOf(jwtobj.payload['session']).value() >= 0) {
    return next();
  }
  
  // It's important that we fail closed
  console.log(`401 - not authenticated - ${req.originalUrl}`);
  return res.status(401).json({error: 'Not Authenticated'});
});

// Mount private modules
_.each(base_modules, (v, i) => {
  if(typeof v.constructor.api == 'function') {
    console.log(`mounting api endpoint, ${i}`)
    
    app.use(`/${i}`, v.constructor.api)
  }
});

This allows us to avoid having to authenticate every API endpoint. Authentication here will fail before any 'private' APIs can be hit, allowing us to write clean and verbose code.

Example:

// Scripts route
router.all('/', async (req, res) => {
  // Hooray, we already know we have authenticated. We do not need to do any additional checking before running the below dangerous code

  let result = await context.scripts.get_scripts()
  res.json({success: true, result: result})
})