Comprehensive comparison for Authentication technology in Software Development applications

// Express.js API with Auth0 JWT Authentication
// This example demonstrates securing API endpoints with Auth0 tokens

const express = require('express');
const { auth, requiredScopes } = require('express-oauth2-jwt-bearer');
const axios = require('axios');

const app = express();
app.use(express.json());

// Auth0 configuration
const AUTH0_DOMAIN = process.env.AUTH0_DOMAIN;
const AUTH0_AUDIENCE = process.env.AUTH0_AUDIENCE;

// Configure JWT validation middleware
const checkJwt = auth({
  audience: AUTH0_AUDIENCE,
  issuerBaseURL: `https://${AUTH0_DOMAIN}/`,
  tokenSigningAlg: 'RS256'
});

// Error handling middleware for authentication errors
const handleAuthError = (err, req, res, next) => {
  if (err.name === 'UnauthorizedError') {
    return res.status(401).json({
      error: 'Unauthorized',
      message: 'Invalid or missing authentication token'
    });
  }
  next(err);
};

// Public endpoint - no authentication required
app.get('/api/public', (req, res) => {
  res.json({
    message: 'Public endpoint accessible to all',
    timestamp: new Date().toISOString()
  });
});

// Protected endpoint - requires valid JWT
app.get('/api/protected', checkJwt, (req, res) => {
  const { sub: userId, permissions } = req.auth;
  
  res.json({
    message: 'Access granted to protected resource',
    userId: userId,
    permissions: permissions || []
  });
});

// Endpoint requiring specific scopes
app.get('/api/admin/users',
  checkJwt,
  requiredScopes('read:users'),
  async (req, res) => {
    try {
      // Simulate database query
      const users = [
        { id: 1, email: '[email protected]', role: 'user' },
        { id: 2, email: '[email protected]', role: 'admin' }
      ];
      
      res.json({
        success: true,
        data: users,
        requestedBy: req.auth.sub
      });
    } catch (error) {
      res.status(500).json({
        error: 'Internal server error',
        message: error.message
      });
    }
  }
);

// Endpoint with multiple required scopes
app.post('/api/admin/users/:id/delete',
  checkJwt,
  requiredScopes('delete:users', 'admin:access'),
  async (req, res) => {
    const { id } = req.params;
    const adminUserId = req.auth.sub;
    
    if (!id) {
      return res.status(400).json({
        error: 'Bad request',
        message: 'User ID is required'
      });
    }
    
    try {
      // Simulate user deletion with audit log
      console.log(`User ${id} deleted by admin ${adminUserId}`);
      
      res.json({
        success: true,
        message: `User ${id} successfully deleted`,
        deletedBy: adminUserId,
        timestamp: new Date().toISOString()
      });
    } catch (error) {
      res.status(500).json({
        error: 'Deletion failed',
        message: error.message
      });
    }
  }
);

// Apply error handling middleware
app.use(handleAuthError);

// Global error handler
app.use((err, req, res, next) => {
  console.error('Unhandled error:', err);
  res.status(500).json({
    error: 'Internal server error',
    message: process.env.NODE_ENV === 'production' ? 'An error occurred' : err.message
  });
});

const PORT = process.env.PORT || 3000;

app.listen(PORT, () => {
  console.log(`API server running on port ${PORT}`);
  console.log(`Auth0 Domain: ${AUTH0_DOMAIN}`);
  console.log(`Auth0 Audience: ${AUTH0_AUDIENCE}`);
});

module.exports = app;