Comprehensive comparison for Authentication technology in Software Development applications

// Production-grade Node.js Express API with Snyk authentication and vulnerability scanning
// This example demonstrates integrating Snyk for security monitoring in a user authentication service

const express = require('express');
const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const snyk = require('snyk');
const { body, validationResult } = require('express-validator');

const app = express();
const PORT = process.env.PORT || 3000;
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key';
const SNYK_TOKEN = process.env.SNYK_TOKEN;

// Security middleware
app.use(helmet());
app.use(express.json());

// Rate limiting to prevent brute force attacks
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many login attempts, please try again later'
});

// Initialize Snyk monitoring
snyk.config.api = SNYK_TOKEN;

// Snyk vulnerability check middleware
async function snykSecurityCheck(req, res, next) {
  try {
    // Check for vulnerabilities in dependencies
    const testResult = await snyk.test('.', {
      org: process.env.SNYK_ORG_ID,
      severity: 'high'
    });

    if (testResult.vulnerabilities && testResult.vulnerabilities.length > 0) {
      console.error('Critical vulnerabilities detected:', testResult.vulnerabilities);
      // Log but don't block in production, alert security team
      req.securityAlert = true;
    }
    next();
  } catch (error) {
    console.error('Snyk security check failed:', error.message);
    next();
  }
}

// User registration endpoint
app.post('/api/auth/register',
  snykSecurityCheck,
  [
    body('email').isEmail().normalizeEmail(),
    body('password').isLength({ min: 8 }).matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])/)
  ],
  async (req, res) => {
    try {
      const errors = validationResult(req);
      if (!errors.isEmpty()) {
        return res.status(400).json({ errors: errors.array() });
      }

      const { email, password } = req.body;

      // Hash password with bcrypt
      const saltRounds = 12;
      const hashedPassword = await bcrypt.hash(password, saltRounds);

      // Store user (simplified - use database in production)
      const user = {
        id: Date.now(),
        email,
        password: hashedPassword,
        createdAt: new Date()
      };

      // Generate JWT token
      const token = jwt.sign(
        { userId: user.id, email: user.email },
        JWT_SECRET,
        { expiresIn: '1h', algorithm: 'HS256' }
      );

      res.status(201).json({
        message: 'User registered successfully',
        token,
        securityStatus: req.securityAlert ? 'monitoring' : 'secure'
      });
    } catch (error) {
      console.error('Registration error:', error);
      res.status(500).json({ error: 'Internal server error' });
    }
  }
);

// User login endpoint with Snyk monitoring
app.post('/api/auth/login',
  loginLimiter,
  snykSecurityCheck,
  [
    body('email').isEmail().normalizeEmail(),
    body('password').notEmpty()
  ],
  async (req, res) => {
    try {
      const errors = validationResult(req);
      if (!errors.isEmpty()) {
        return res.status(400).json({ errors: errors.array() });
      }

      const { email, password } = req.body;

      // Retrieve user (simplified - use database in production)
      const user = { id: 1, email, password: '$2b$12$hashedpassword' };

      if (!user) {
        return res.status(401).json({ error: 'Invalid credentials' });
      }

      // Verify password
      const isValidPassword = await bcrypt.compare(password, user.password);
      if (!isValidPassword) {
        return res.status(401).json({ error: 'Invalid credentials' });
      }

      // Generate JWT token
      const token = jwt.sign(
        { userId: user.id, email: user.email },
        JWT_SECRET,
        { expiresIn: '1h', algorithm: 'HS256' }
      );

      res.json({
        message: 'Login successful',
        token,
        securityStatus: req.securityAlert ? 'monitoring' : 'secure'
      });
    } catch (error) {
      console.error('Login error:', error);
      res.status(500).json({ error: 'Internal server error' });
    }
  }
);

// Protected route with JWT verification
function authenticateToken(req, res, next) {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (!token) {
    return res.status(401).json({ error: 'Access token required' });
  }

  jwt.verify(token, JWT_SECRET, (err, user) => {
    if (err) {
      return res.status(403).json({ error: 'Invalid or expired token' });
    }
    req.user = user;
    next();
  });
}

app.get('/api/protected', authenticateToken, (req, res) => {
  res.json({
    message: 'Access granted to protected resource',
    user: req.user
  });
});

app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
  console.log('Snyk security monitoring enabled');
});

module.exports = app;