Blog | G5 Cyber Security

Secure Client Server Authentication

G5 Cyber Security

TL;DR

This guide shows you how to add secure authentication to your client-server application using a common pattern: username/password login with token-based verification. We’ll cover creating user accounts, hashing passwords, generating tokens, and verifying those tokens on each request.

1. User Account Creation

  1. Database Setup: You’ll need a database to store user information (username, hashed password, potentially other details). Choose a suitable database like PostgreSQL, MySQL, or SQLite.
  2. Registration Endpoint: Create an API endpoint for new users to register. This endpoint should:
    • Accept username and password as input.
    • Validate the inputs (e.g., check for minimum length, valid characters).
    • Hash the password using a strong hashing algorithm like bcrypt or Argon2. 
      # Example using Python and bcrypt
import bcrypt
hashed_password = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt())
    • Store the username and hashed password in your database. Never store passwords in plain text!

2. Login Process

  1. Login Endpoint: Create an API endpoint for users to log in.
    • Accept username and password as input.
    • Retrieve the user from the database based on the provided username.
    • Compare the provided password with the stored hashed password using the same hashing algorithm used during registration. 
      # Example using Python and bcrypt
if bcrypt.checkpw(password.encode('utf-8'), hashed_password):
    # Password matches!
else:
    # Incorrect password
    • If the passwords match, generate a JSON Web Token (JWT). 
      # Example using Python and PyJWT
import jwt
payload = {'username': username}
token = jwt.encode(payload, 'your_secret_key', algorithm='HS256')
    • Return the JWT to the client.

3. Token Verification (Middleware)

  1. Middleware Implementation: Implement middleware that intercepts all protected API requests.
    • Extract the token from the request headers (e.g., Authorization: Bearer <token>).
    • Verify the token’s signature using your secret key. 
      # Example using Python and PyJWT
try:
    payload = jwt.decode(token, 'your_secret_key', algorithms=['HS256'])
except jwt.ExpiredSignatureError:
    # Token has expired
except jwt.InvalidTokenError:
    # Invalid token
    • If the token is valid, attach the user information (from the payload) to the request object. 
      request.user = payload['username']  # Attach username to request
    • If the token is invalid or expired, return an error response (e.g., 401 Unauthorized).

4. Protecting API Endpoints

  1. Apply Middleware: Apply your authentication middleware to all API endpoints that require authentication.
  2. Access User Information: Within protected endpoints, access the user information attached to the request object by the middleware (e.g., request.user).

5. Security Considerations

Exit mobile version