ክፍል 17 | JWT & bcrypt — Authentication 🔐

01 🤔

Authentication ምንድን ነው?// Who Are You?

Authentication (Auth) = "ይህ ሰው ማን ነው? Login ሆኗልን?" — ለዚህ 2 ዋና tools እንጠቀማለን:
bcrypt — Password ን ደህንነቱ ባለ መልኩ hash ያደርጋል
JWT — Login ከሆነ በኋላ token ይሰጣል — ቀጣይ requests token ያስፈልጋቸዋል!
Authentication = verifying WHO the user is. bcrypt protects passwords. JWT proves the user is logged in.

💡 ምሳሌ ተጠቅሞ ለመረዳት — Hotel Analogy

bcrypt

🔑 Passport ማረጋገጫ

Password ን ቀጥታ አናስቀምጥ — hash ሆኖ ይቀመጣል! ሌላ ሰው ቢሰርቅ አያነበውም!

→

JWT Token

🎫 Hotel Room Key Card

Login ከሆነ key card ይሰጣሃል — ቀጣይ ሁሉም rooms ያ key ብቻ ይከፍታቸዋል!

Register

📝 Hotel Check-in

Password hash ሆኖ Database ይቀመጣል

→

Login

✅ Check — JWT ይሰጣሃል

Password ትክክል ከሆነ JWT token ይሰጣሃል

02 🔄

Auth Flow — ሙሉ ሂደት// Register → Login → Protected

ምዝገባ ከ Protected Route ድረስ — ሙሉ ሂደት:

STEP 01

📝

Register

Password hash ሆኖ DB ይቀመጣል

→

STEP 02

🔐

Login

bcrypt compare → JWT token ይሰጣሃል

→

STEP 03

🎫

Store Token

localStorage ወይም cookie

→

STEP 04

📡

API Request

Header: Bearer TOKEN

→

STEP 05

✅

Verify

Server token ያረጋግጣል → Response

03 🔒

bcrypt — Password Hashing// Never Store Plain Text!

Password ን ቀጥታ Database አትቀምጥ! ሌላ ሰው DB ቢሰርቅ ሁሉም passwords ያያቸዋል! bcrypt password ን hash (ሊነበብ የማይቻል string) ያደርገዋል!
NEVER store plain text passwords! bcrypt hashes them into an unreadable string. Even bcrypt can't reverse it — can only verify!

❌ ቀጥታ DB ውስጥ
"password123"

→

✅ Hash ሆኖ DB ውስጥ
"$2b$10$N9qo8uLOick...xWyF8"

auth.js — bcrypt Register & Login

const bcrypt   = require('bcryptjs');   // npm install bcryptjs
const User     = require('../models/User');

// ── REGISTER ─────────────────────────────────────
router.post('/register', async (req, res) => {
  const { name, email, password } = req.body;

  // 1. Email አስቀድሞ አለ?
  const exists = await User.findOne({ email });
  if (exists) return res.status(400).json({ error: 'Email in use' });

  // 2. Password hash ያድርግ (10 = salt rounds)
  const hashed = await bcrypt.hash(password, 10);

  // 3. Hash ሆነ ብቻ DB ውስጥ ቀምጥ — ቀጥታ አይደለም!
  const user = await User.create({ name, email, password: hashed });

  res.status(201).json({ success: true, message: 'Registered!' });
});

// ── LOGIN ─────────────────────────────────────────
router.post('/login', async (req, res) => {
  const { email, password } = req.body;

  // 1. User ፈልግ
  const user = await User.findOne({ email });
  if (!user) return res.status(400).json({ error: 'Invalid credentials' });

  // 2. Password ያረጋግጥ (plain vs hashed)
  const match = await bcrypt.compare(password, user.password);
  if (!match) return res.status(400).json({ error: 'Invalid credentials' });

  // 3. JWT token ስጥ ← ቀጥሎ እናያለን!
  const token = jwt.sign({ id: user._id }, process.env.JWT_SECRET, { expiresIn: '7d' });

  res.json({ success: true, token });
});

04 🎫

JWT — JSON Web Token// Stateless Auth

JWT = Login ስኬታማ ሲሆን server token ይሰጣል — ቀጣይ requests ሁሉ ያ token ያስፈልጋቸዋል! Server session አያስቀምጥም — token ራሱ ሁሉን ይዟል!
JWT is a self-contained token. The server doesn't store sessions — it just verifies the token signature on every request!

🔍 JWT Structure — 3 ክፍሎች dot ሆኖ ይዋሃዳሉ:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 . eyJpZCI6IjY0YTNmIiwibmFtZSI6IkFiZWwiLCJpYXQiOjE2OTk5fQ . SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

HeaderAlgorithm type

PayloadUser data (id, name...)

SignatureVerify yadergal

middleware/protect.js — JWT Verify Middleware

const jwt = require('jsonwebtoken');  // npm install jsonwebtoken

// ── Middleware — ሁሉም protected routes ይጠቀሙታል ──
function protect(req, res, next) {
  // 1. Header ውስጥ token አለ?
  const authHeader = req.headers.authorization;
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'No token — Login ያስፈልጋል!' });
  }

  // 2. Token ን ለይ (Bearer xxxxx → xxxxx)
  const token = authHeader.split(' ')[1];

  try {
    // 3. Token ን ያረጋግጥ
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = decoded; // user info ወደ request ጨምር
    next();             // ቀጥሎ ያለው route ይሂድ
  } catch (err) {
    res.status(401).json({ error: 'Invalid token!' });
  }
}

// ── Protected routes ──────────────────────────────
router.get('/profile', protect, (req, res) => {
  res.json({ user: req.user }); // token ካለ ብቻ ይሰጣል!
});

router.get('/dashboard', protect, (req, res) => {
  res.json({ message: 'ሰላም! Dashboard ተከፈተ!' });
});

🛡️ Route Protection Levels:

GET /api/lessons 🌐 Public

GET /api/profile 🔐 Login ያስፈልጋል

POST /api/posts 🔐 Login ያስፈልጋል

PUT /api/admin/users 👑 Admin Only

DELETE /api/admin/posts/:id 👑 Admin Only

05 🎮

Live Auth Demo// Register · Login · Protected

ሙሉ Authentication system ሞክር! Register → Password hash ይሆናል | Login → JWT token ይሰጥሃል | Protected Route → Token ካሌ ይከልክላል!
Full auth flow simulation — register, login, and test protected routes with and without a token!

📝 Register

🔑 Login

🛡️ Protected Route

👤 ስም / Full Name

✉️ Email

🔒 Password

Password ጻፍ...

06 📌

ዋና ዋና ነጥቦች// Key Takeaways

1

🔒 bcrypt — Password ቀጥታ አትቀምጥ!

bcrypt.hash(password, 10) — 10 salt rounds = ኃይለኛ hash! bcrypt.compare(plain, hash) — verify ለማድረግ!
Never store plain passwords. Hash with 10+ salt rounds. Use bcrypt.compare() to verify on login.

2

🎫 JWT — Token Based Auth

jwt.sign({'{'}id{'}'},secret,{'{'}expiresIn:'7d'{'}'}) → token ይሰጣሃል! jwt.verify(token,secret) → ያረጋግጣሃል!
Sign a token on login. Verify it on every protected request. Set expiration (7d, 1h, etc).

3

🛡️ Middleware — Routes ለማስጠበቅ

function protect(req,res,next) — Header ውስጥ token ያረጋግጣል። Protected routes ሁሉ ይጠቀሙታል!
Middleware checks for valid JWT before allowing access to protected routes.

4

🔑 Authorization Header

Client: Authorization: Bearer <token> — ሁሉም protected request ይህን header ይልካል!
Send token as: Authorization: Bearer eyJhbGci... in every authenticated request header.

5

🌍 .env — Secrets ማስቀመጫ

JWT_SECRET=mysecretkey123 — .env file ውስጥ ቀምጥ! GitHub ላይ ፈጽሞ አትጫን!
Store JWT_SECRET in .env file. Add .env to .gitignore — NEVER commit secrets to GitHub!

07 🎯

Quiz// ምን ተማርን?

❓ Password ን Database ከማስቀመጥ በፊት ምን ማድረግ አለብን?

What must we do to a password BEFORE storing it in the database?

A ቀጥታ String ሆኖ ያስቀምጡ — "password123"

B Base64 encode ያድርጉ

C bcrypt.hash() ተጠቅሞ Hash ያድርጉ ✅

D JWT ውስጥ ያስቀምጡ

JWT & bcrypt Authentication 🔐