Cementify Express JS code

In authentication, when the user successfully logs in using his credentials, a JSON Web Token will be returned and must be saved locally (typically in local storage, but cookies can be also used), instead of the traditional approach of creating a session in the server and returning a cookie.

https://auth0.com/learn/json-web-tokens

JWT

learn about jwt - https://scotch.io/tutorials/the-anatomy-of-a-json-web-token

session with cookies/redis - http://blog.modulus.io/nodejs-and-express-sessions

choose auth strategy - https://stormpath.com/blog/choosing-nodejs-authentication-strategy/

sessions pose a scalability prob - https://scotch.io/tutorials/the-ins-and-outs-of-token-based-authentication#introduction

*full example

http://blog.matoski.com/articles/jwt-express-node-mongoose/#how-we-used-auth

express-jwt

https://auth0.com/docs/server-apis/nodejs

manipulate jwt

http://www.dwmkerr.com/modifying-a-jwt-in-a-node-application/

I think this login design has hack bug.Some one can intercept user's http request and get the token.So that the hacker can simulate a request to login.Right?

In the same way that someone can intercept a cookie. Use ssl

passport and jwt

http://stackoverflow.com/questions/20228572/passport-local-with-node-jwt-simple

just pseudo of jwt

https://coderead.wordpress.com/2012/08/16/securing-node-js-restful-services-with-jwt-tokens/

MemoryStore is just for (rapid) development mode, because if your app restarts (process dies) you will lose all the session data (that resided in the memory of that process).

If you don't want to use a database, use encrypted cookie storage instead.

and memoryStore clean up

http://stackoverflow.com/questions/10760620/using-memorystore-in-production

use redis instead of memoryStore on the box

http://www.hacksparrow.com/use-redisstore-instead-of-memorystore-express-js-in-production.html

http://blog.modulus.io/nodejs-and-express-sessions

Warning The default server-side session storage, MemoryStore, is purposely not designed for a production environment. It will leak memory under most conditions, does not scale past a single process, and is meant for debugging and developing.

use cookie instead of memoryStore

http://stackoverflow.com/questions/10966689/set-client-side-accessible-cookie-in-express

secure node

http://scottksmith.com/blog/2014/09/04/simple-steps-to-secure-your-express-node-application/

for req.cookies

https://github.com/expressjs/cookie-parser

deep dive

https://www.airpair.com/express/posts/expressjs-and-passportjs-sessions-deep-dive

asynchronous

http://stackoverflow.com/questions/23667086/why-is-my-variable-unaltered-after-i-modify-it-inside-of-a-function-asynchron

node-dirty

Purpose

A tiny & fast key value store with append-only disk log. Ideal for apps with < 1 million records.

Installation

npm install dirty

Why dirty?

This module is called dirty because:

The file format is newline separated JSON
Your database lives in the same process as your application, they share memory
There is no query language, you just forEach through all records

So dirty means that you will hit a very hard wall with this database after ~1 million records, but it is a wonderful solution for anything smaller than that.

Tutorial

  var dirty = require('dirty');
  var db = dirty('user.db');

  db.on('load', function() {
    db.set('john', {eyes: 'blue'});
    console.log('Added john, he has %s eyes.', db.get('john').eyes);

    db.set('bob', {eyes: 'brown'}, function() {
      console.log('User bob is now saved on disk.')
    });

    db.forEach(function(key, val) {
      console.log('Found key: %s, val: %j', key, val);
    });
  });

  db.on('drain', function() {
    console.log('All records are saved on disk now.');
  });

Output:

Added john, he has blue eyes.
Found key: john, val: {"eyes":"blue"}
Found key: bob, val: {"eyes":"brown"}
User bob is now saved on disk.
All records are saved on disk now.

rnjailamba/website

Cementify Express JS code

Purpose

Awesome chrome-devtools

node-dirty

Purpose

Installation

Why dirty?

Tutorial