I am designing a REST Api for a mobile application and have some worries over properly securing access to accounts.
I am writing the API server in nodeJS and it will primarily be consumed by a mobile client (although a web client may be added in the future)
There are 2 main side aspects I wish to incorporate in the auth process:
- Users ID is encoded in the token (to reduce stress on DB)
- User can have only 1 valid token at any one time (login nulls any previous token)
Here is my initial design (all endpoints are over SSL):
Login
- User POST's her username & password to '/login'
- Server verifies users exists and the password matches the bcrypt hash in the Db
- Server generates a uuid v4 for the user and stores this in Reds with the users ID as the key
- The users uuid and user ID are then encoded in a Json Web Token with an expiration time of 1 week
- The JWT is then sent back to the users as their authentication Token
Protected Route
- User sends GET request '/users/me' withe her token set as Authorization: Bearer header
- Server verifies the JWT and sends appropriate error responses if verification fails
- Server then queries the Redis store and verifies the uuid stored for the user matches the uuid encoded in the JWT
- If uuids match the users id is set to req.user and the request is processed, if not then error message is sent back
Does this look like a good authentication strategy or am I way off?