Comprehensive comparison for Authentication technology in Software Development applications

const express = require('express');
const { auth, requiresAuth } = require('express-openid-connect');
const jwt = require('jsonwebtoken');
const jwksRsa = require('jwks-rsa');
const axios = require('axios');

const app = express();
app.use(express.json());

// Auth0 Configuration
const config = {
  authRequired: false,
  auth0Logout: true,
  secret: process.env.AUTH0_SECRET,
  baseURL: process.env.BASE_URL || 'http://localhost:3000',
  clientID: process.env.AUTH0_CLIENT_ID,
  issuerBaseURL: process.env.AUTH0_ISSUER_BASE_URL,
  audience: process.env.AUTH0_AUDIENCE
};

// Initialize Auth0 middleware
app.use(auth(config));

// JWKS client for token verification
const jwksClient = jwksRsa({
  jwksUri: `${process.env.AUTH0_ISSUER_BASE_URL}/.well-known/jwks.json`,
  cache: true,
  rateLimit: true,
  jwksRequestsPerMinute: 5
});

// Middleware to verify JWT tokens for API routes
const verifyToken = async (req, res, next) => {
  try {
    const token = req.headers.authorization?.split(' ')[1];
    
    if (!token) {
      return res.status(401).json({ error: 'No token provided' });
    }

    const decoded = jwt.decode(token, { complete: true });
    if (!decoded || !decoded.header.kid) {
      return res.status(401).json({ error: 'Invalid token format' });
    }

    const key = await jwksClient.getSigningKey(decoded.header.kid);
    const signingKey = key.getPublicKey();

    const verified = jwt.verify(token, signingKey, {
      audience: process.env.AUTH0_AUDIENCE,
      issuer: `${process.env.AUTH0_ISSUER_BASE_URL}/`,
      algorithms: ['RS256']
    });

    req.user = verified;
    next();
  } catch (error) {
    console.error('Token verification error:', error.message);
    return res.status(401).json({ error: 'Invalid or expired token' });
  }
};

// Check user permissions middleware
const checkPermissions = (requiredPermissions) => {
  return (req, res, next) => {
    const permissions = req.user?.permissions || [];
    const hasPermission = requiredPermissions.every(p => permissions.includes(p));
    
    if (!hasPermission) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    next();
  };
};

// Public route - no authentication required
app.get('/', (req, res) => {
  res.json({
    message: 'Welcome to the API',
    authenticated: req.oidc.isAuthenticated()
  });
});

// Protected web route - requires session authentication
app.get('/profile', requiresAuth(), (req, res) => {
  res.json({
    user: req.oidc.user,
    idToken: req.oidc.idToken
  });
});

// Protected API route - requires JWT token
app.get('/api/products', verifyToken, async (req, res) => {
  try {
    // Simulated database query
    const products = [
      { id: 1, name: 'Product A', price: 29.99 },
      { id: 2, name: 'Product B', price: 49.99 }
    ];
    
    res.json({
      user: req.user.sub,
      products: products
    });
  } catch (error) {
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Admin-only route - requires specific permissions
app.post('/api/products', verifyToken, checkPermissions(['create:products']), async (req, res) => {
  try {
    const { name, price } = req.body;
    
    if (!name || !price) {
      return res.status(400).json({ error: 'Missing required fields' });
    }

    // Simulated product creation
    const newProduct = {
      id: Date.now(),
      name,
      price,
      createdBy: req.user.sub,
      createdAt: new Date().toISOString()
    };

    res.status(201).json(newProduct);
  } catch (error) {
    res.status(500).json({ error: 'Failed to create product' });
  }
});

// Error handling middleware
app.use((err, req, res, next) => {
  console.error('Application error:', err);
  res.status(err.status || 500).json({
    error: err.message || 'Internal server error'
  });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});