This project is an example of implementation of a user email authentication with Nestjs v8.4.6, MongoDB and PassportJs
It can be used as starter for a new project: it implements API for user sign-in/sign-up and features like email verification, forgotten password, reset password, update profile and settings.
Install nodejs
and mongodb
in your machine.
Install dependencies with npm and run the application:
npm install
npm run start
⚠️ Before deploy the app in a container set the right configuration as explained in the section below, and then you can run:
docker-compose up -d
It will generate 3 containers:
You can edit the config is in docker-compose.yml
.
❗ Note: For security reason, remember to change the db password in docker-compose.yml and in config.ts file, and to change the mongo-express password to access the console.
You can find a config.ts
file in the root of the project.
Before run the server set your db configuration (according you are using docker or not) and your :email: Nodemailer options to be able to send emails for registration:
# Docker Example #
"db": {
"user": "root",
"pass": "example",
"host": "mongo",
"port": "27017",
"database": "testdb",
"authSource": "admin"
}
# Local nodejs Example #
"db": {
"user": null,
"pass": null,
"host": "localhost",
"port": "27017",
"database": "testdb",
"authSource": null
}
...
"host": {
"url": "<server-url>", //This link is used to redirect users to your server to confirm their email address (link via email)
"port": "3000"
},
...
"mail":{
"host": "<smtp-host>", //Nodemailer settings (go to the nodemailer documentation for further informations) - You need to set up this to make the signup api start working
"port": "<port>",
"secure": false,
"user": "<username>",
"pass": "<password>"
}
Server will listen on port 3000
, and it expose the following APIs:
POST - /auth/email/register
- Register a new user
POST - /auth/email/login
- Login user
GET - /auth/email/verify/:token
- Validates the token sent in the email and activates the user's account
GET - /auth/email/resend-verification/:email
- Resend verification email
GET - /auth/email/forgot-password/:email
- Send a token via email to reset the password
POST - /auth/email/reset-password
- Change user password
GET - /auth/users
- Returns all users (must be logged in)
GET - /users/user/:email
- Returns selected user info (must be logged in)
POST - /users/profile/update
- Update user info
POST - /users/gallery/update
- Add/Remove user photos
POST - settings/update
- Update user settings
This project use JSON Web Token (JWT) Bearer Token as authentication strategy for Passport. The login API returns an access_token that you have to use to send a correct authorization header in calls that require authentication. You can find an example with postman here
Login response:
{
...
"data": {
"token": {
"expires_in": "3600",
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...._DkYJJh4s"
},
...
}
Authorization header example:
Authorization → Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...._DkYJJh4s
All request and response are logged so this can help you to debug in production. If you use pm2 as process manager, I suggest you to install pm2-logrotate in your server.
The project implements some of nodejs security techniques :
If you want to contribute to this starter, consider:
All contributions are welcome!
Licensed under the MIT license.