Comprehensive comparison for Authentication technology in Software Development applications

// Node.js Express API with Auth0 JWT Authentication
// Production-ready example for protecting API endpoints

const express = require('express');
const { auth, requiredScopes } = require('express-oauth2-jwt-bearer');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');

const app = express();

// Security middleware
app.use(helmet());
app.use(express.json());

// Rate limiting to prevent abuse
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100 // limit each IP to 100 requests per windowMs
});
app.use(limiter);

// Auth0 JWT validation middleware
const checkJwt = auth({
  audience: process.env.AUTH0_AUDIENCE,
  issuerBaseURL: process.env.AUTH0_ISSUER_BASE_URL,
  tokenSigningAlg: 'RS256'
});

// Custom error handler for authentication errors
const handleAuthError = (err, req, res, next) => {
  if (err.name === 'UnauthorizedError') {
    return res.status(401).json({
      error: 'Unauthorized',
      message: 'Invalid or missing authentication token',
      code: 'AUTH_FAILED'
    });
  }
  if (err.name === 'InsufficientScopeError') {
    return res.status(403).json({
      error: 'Forbidden',
      message: 'Insufficient permissions to access this resource',
      code: 'INSUFFICIENT_SCOPE'
    });
  }
  next(err);
};

// Public endpoint - no authentication required
app.get('/api/public', (req, res) => {
  res.json({
    message: 'Public endpoint accessible to everyone',
    timestamp: new Date().toISOString()
  });
});

// Protected endpoint - requires valid JWT
app.get('/api/protected', checkJwt, (req, res) => {
  res.json({
    message: 'Protected resource accessed successfully',
    user: req.auth.sub,
    timestamp: new Date().toISOString()
  });
});

// Scope-protected endpoint - requires specific permissions
app.get('/api/admin/users', 
  checkJwt, 
  requiredScopes('read:users'),
  async (req, res) => {
    try {
      // Simulate database query
      const users = [
        { id: 1, email: '[email protected]', role: 'user' },
        { id: 2, email: '[email protected]', role: 'admin' }
      ];
      
      res.json({
        data: users,
        requestedBy: req.auth.sub,
        timestamp: new Date().toISOString()
      });
    } catch (error) {
      res.status(500).json({
        error: 'Internal Server Error',
        message: 'Failed to retrieve users'
      });
    }
  }
);

// Protected POST endpoint with data validation
app.post('/api/products',
  checkJwt,
  requiredScopes('write:products'),
  async (req, res) => {
    try {
      const { name, price, description } = req.body;
      
      // Input validation
      if (!name || !price) {
        return res.status(400).json({
          error: 'Bad Request',
          message: 'Name and price are required fields'
        });
      }
      
      if (typeof price !== 'number' || price <= 0) {
        return res.status(400).json({
          error: 'Bad Request',
          message: 'Price must be a positive number'
        });
      }
      
      // Simulate product creation
      const product = {
        id: Math.floor(Math.random() * 10000),
        name,
        price,
        description: description || '',
        createdBy: req.auth.sub,
        createdAt: new Date().toISOString()
      };
      
      res.status(201).json({
        message: 'Product created successfully',
        data: product
      });
    } catch (error) {
      res.status(500).json({
        error: 'Internal Server Error',
        message: 'Failed to create product'
      });
    }
  }
);

// Apply authentication error handler
app.use(handleAuthError);

// Global error handler
app.use((err, req, res, next) => {
  console.error('Unhandled error:', err);
  res.status(500).json({
    error: 'Internal Server Error',
    message: 'An unexpected error occurred'
  });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});