User Authentication System

This project is a backend User Authentication System built using Node.js, Express.js, MongoDB, Mongoose, bcryptjs, and JSON Web Token (JWT).

It allows users to register, login, and access protected routes using JWT-based authentication.

This project was developed as part of my internship task at Synctecxhub.

---

Features

• User signup
• User login
• Password hashing using bcryptjs
• JWT token generation after login
• Protected routes using authentication middleware
• Token expiry handling
• Invalid credentials handling
• Input validation
• Proper HTTP status codes and response messages
• API testing using Postman

---

Technologies Used

• Node.js
• Express.js
• MongoDB
• Mongoose
• bcryptjs
• JSON Web Token
• dotenv
• Nodemon
• Postman

---

Project Structure

auth-system/ │ ├── models/ │ └── User.js │ ├── routes/ │ └── authRoutes.js │ ├── middleware/ │ └── authMiddleware.js │ ├── .env.example ├── server.js ├── package.json └── README.md

---

Installation and Setup

1. Clone the Repository

git clone https://github.com/your-username/your-repository-name.git

2. Go to the Project Folder

cd your-repository-name

3. Install Dependencies

npm install

4. Create .env File

Create a .env file in the root folder and add the following:

PORT=5000 MONGO_URI=mongodb://127.0.0.1:27017/auth_system_db JWT_SECRET=your_jwt_secret_key JWT_EXPIRES_IN=1h

5. Start the Server

npm run dev

The server will run on:

http://localhost:5000

---

API Endpoints

Method	Endpoint	Description	Protected
POST	/api/auth/signup	Register a new user	No
POST	/api/auth/login	Login user and get JWT token	No
GET	/api/auth/profile	Get logged-in user profile	Yes

---

Request and Response Examples

1. Signup User

Endpoint

POST /api/auth/signup

Request Body

{ "username": "john", "email": "john@example.com", "password": "123456" }

Success Response

{ "success": true, "message": "User registered successfully", "data": { "id": "USER_ID", "username": "john", "email": "john@example.com" } }

Status Code

201 Created

---

2. Login User

Endpoint

POST /api/auth/login

Request Body

{ "email": "john@example.com", "password": "123456" }

Success Response

{ "success": true, "message": "Login successful", "token": "YOUR_JWT_TOKEN", "data": { "id": "USER_ID", "username": "john", "email": "john@example.com" } }

Status Code

200 OK

---

3. Access Protected Profile Route

Endpoint

GET /api/auth/profile

Authorization

In Postman, go to the Authorization tab:

Type: Bearer Token
Token: Paste your JWT token here

Or add this in Headers:

Authorization: Bearer YOUR_JWT_TOKEN

Success Response

{ "success": true, "message": "Protected profile accessed successfully", "data": { "_id": "USER_ID", "username": "john", "email": "john@example.com", "createdAt": "2026-05-14T00:00:00.000Z", "updatedAt": "2026-05-14T00:00:00.000Z" } }

Status Code

200 OK

---

Error Responses

Missing Required Fields

{ "success": false, "message": "Username, email and password are required" }

Status Code:

400 Bad Request

---

Email Already Registered

{ "success": false, "message": "Email already registered" }

Status Code:

409 Conflict

---

Invalid Email or Password

{ "success": false, "message": "Invalid email or password" }

Status Code:

401 Unauthorized

---

No Token Provided

{ "success": false, "message": "Access denied. No token provided." }

Status Code:

401 Unauthorized

---

Invalid Token

{ "success": false, "message": "Invalid token. Authentication failed." }

Status Code:

401 Unauthorized

---

Expired Token

{ "success": false, "message": "Token expired. Please login again." }

Status Code:

401 Unauthorized

---

Status Codes Used

Status Code	Meaning
200	Request successful
201	User registered successfully
400	Bad request or validation error
401	Unauthorized request
409	Email already exists
500	Server error

---

Postman Testing Steps

1. Open Postman.
2. Test the signup API using POST /api/auth/signup.
3. Test the login API using POST /api/auth/login.
4. Copy the JWT token from the login response.
5. Go to the protected profile API using GET /api/auth/profile.
6. Add the token in the Authorization tab as a Bearer Token.
7. Send the request and check the protected user data.

---

Security Implementation

• Passwords are not stored in plain text.
• bcryptjs is used to hash passwords before storing them in MongoDB.
• JWT is generated after successful login.
• Protected routes can only be accessed with a valid token.
• Expired and invalid tokens are handled properly.

---

Future Improvements

• Add role-based access control
• Add refresh token functionality
• Add forgot password and reset password feature
• Add email verification
• Add stronger password validation
• Add logout functionality
• Add user profile update feature

---

Internship Task

This project was completed as part of my internship at Synctecxhub.

The main goal of this task was to understand backend authentication, secure password handling, JWT-based authorization, protected routes, and API testing using Postman.

---

Author

Vikas Kushwaha