Mail

Project Overview

Secure Authentication API is a production-grade REST API designed with security-first principles, implementing enterprise-level authentication and authorization patterns.

Key Characteristics:

Security-hardened authentication system
Scalable microservice architecture
Comprehensive threat mitigation
Production deployment automation
Real-time monitoring and logging

Technical Stack

Core Technologies

Runtime: Node.js with TypeScript
Framework: Express.js with security middleware
Database: PostgreSQL with connection pooling
Cache/Session Store: Redis with persistence
Containerization: Docker with multi-stage builds
CI/CD: GitHub Actions with automated deployment

Security Libraries

Password Hashing: bcryptjs (12 rounds)
JWT Implementation: jsonwebtoken with RS256 algorithm
Rate Limiting: express-rate-limit with Redis store
Input Validation: Joi schema validation
Security Headers: helmet.js configuration

Authentication Architecture

JWT Token Strategy

Access Token Design:

Lifetime: 15 minutes (short-lived)
Algorithm: RS256 with RSA key pairs
Claims: User ID, roles, issued/expiry timestamps
Storage: Client-side (memory/secure storage)

Refresh Token Implementation:

Lifetime: 7 days (configurable)
Storage: Redis with automatic expiration
Security: Cryptographically secure random generation
Rotation: Automatic invalidation on use

// Token refresh flow
POST /auth/refresh
{
  "refreshToken": "secure_random_token"
}

// Response includes new token pair
{
  "accessToken": "new_jwt_token",
  "refreshToken": "new_refresh_token"
}

Refresh Token Rotation Security

Implementation Details:

Each refresh token is single-use only
Used tokens are immediately blacklisted in Redis
Token reuse triggers security alerts
Family-based token tracking for compromise detection

Security Benefits:

Eliminates token replay attacks
Reduces session hijacking window
Enables automatic compromise detection
Provides audit trail for suspicious activity

Security Implementation

Password Security

Hashing Strategy:

bcryptjs with 12-round salt generation
Passwords never stored in plaintext
No password data in logs or responses
Secure password reset with time-limited tokens

Account Protection:

// Account lockout configuration
MAX_LOGIN_ATTEMPTS: 5
LOCKOUT_DURATION: 15 minutes
PROGRESSIVE_DELAY: Exponential backoff

Rate Limiting Architecture

Multi-tier Rate Limiting:

// Authentication endpoints
LOGIN_LIMIT: 5 requests/15 minutes per IP
REGISTER_LIMIT: 3 requests/hour per IP
REFRESH_LIMIT: 10 requests/minute per user

// General API endpoints
API_LIMIT: 100 requests/15 minutes per IP
ADMIN_LIMIT: 50 requests/hour per admin user

Implementation Features:

Redis-backed sliding window counters
Per-IP and per-user rate limiting
Different limits for different endpoint categories
Automatic rate limit header responses

Role-Based Access Control (RBAC)

Role Implementation:

enum UserRole {
  USER = 'USER',
  ADMIN = 'ADMIN'
}

// Middleware protection
@RequireRole(UserRole.ADMIN)
async adminEndpoint() { /* ... */ }

Access Control Matrix:

Public Endpoints: Registration, login
User Endpoints: Profile management, password change
Admin Endpoints: User management, system monitoring
Protected Resources: Role-based data filtering

Security Headers & CORS

HTTP Security Headers

// Helmet.js configuration
app.use(
  helmet({
    hsts: { maxAge: 31536000, includeSubDomains: true },
    contentSecurityPolicy: {
      directives: {
        defaultSrc: ["'self'"],
        styleSrc: ["'self'", "'unsafe-inline'"],
      },
    },
    xssFilter: true,
    noSniff: true,
    frameguard: { action: 'deny' },
  })
)

CORS Configuration

Whitelist-based origin control
Credentials support for authenticated requests
Method and header restrictions
Preflight request handling

Input Validation & Data Security

Schema Validation

// Registration validation example
const registerSchema = Joi.object({
  email: Joi.string().email().required(),
  password: Joi.string()
    .min(8)
    .pattern(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/)
    .required(),
  name: Joi.string().min(2).max(50).required(),
})

Validation Features:

Comprehensive input sanitization
SQL injection prevention
XSS attack mitigation
Data type and format enforcement

Database Security

Parameterized queries only
Connection pooling with limits
Database user with minimal privileges
Regular security updates

Audit Logging & Monitoring

Security Event Logging

Logged Events:

// Authentication events
- Successful/failed login attempts
- Account lockouts and unlocks
- Password changes and resets
- Token refresh and invalidation

// Authorization events
- Access denials and privilege escalation attempts
- Admin action audits
- Suspicious activity patterns

Log Security:

Sensitive data automatically masked
Structured JSON formatting
Centralized log aggregation ready
Retention policy compliance

Health Monitoring

// Health check endpoints
GET / health // Basic API health
GET / health / detailed // Service dependencies
GET / health / database // PostgreSQL connectivity
GET / health / cache // Redis connectivity

Architecture & Design Patterns

Clean Architecture Implementation

┌─────────────────────────────────────┐
│           Controllers               │
│    (HTTP request/response)          │
├─────────────────────────────────────┤
│             Services                │
│      (Business logic)               │
├─────────────────────────────────────┤
│           Repositories              │
│       (Data access)                 │
├─────────────────────────────────────┤
│            Database                 │
│    (PostgreSQL + Redis)             │
└─────────────────────────────────────┘

Benefits:

Clear separation of concerns
Testable business logic
Technology-agnostic core
Maintainable codebase structure

Error Handling Strategy

// Global error handler
app.use((error: Error, req: Request, res: Response, next: NextFunction) => {
  // Log security-relevant errors
  if (error instanceof SecurityError) {
    auditLogger.warn('Security violation', {
      ip: req.ip,
      endpoint: req.path,
    })
  }

  // Return safe error responses
  res.status(error.statusCode || 500).json({
    error: error.message || 'Internal server error',
  })
})

Deployment & DevOps

Docker Configuration

Multi-stage Build:

# Build stage
FROM node:18-alpine AS builder
COPY package*.json ./
RUN npm ci --only=production

# Production stage
FROM node:18-alpine AS production
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nextjs -u 1001
COPY --from=builder --chown=nextjs:nodejs /app ./
USER nextjs
EXPOSE 3000
CMD ["npm", "start"]

Security Features:

Non-root user execution
Minimal attack surface
Secrets via environment variables
Health check integration

CI/CD Pipeline

# GitHub Actions workflow
name: Deploy API
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to production
        run: |
          ssh ${{ secrets.HOST }} "
            cd /opt/auth-api &&
            git pull origin main &&
            docker-compose build --no-cache &&
            docker-compose up -d
          "

Pipeline Features:

Automated testing before deployment
Zero-downtime deployment strategy
Rollback capability
Environment-specific configurations

Performance & Scalability

Database Optimization

Connection pooling (10 connections)
Query optimization and indexing
Read replicas ready architecture
Database migration system

Caching Strategy

Redis for session storage
API response caching where appropriate
Connection pooling for Redis
Automatic cache invalidation

Monitoring Integration

Application metrics collection
Database performance monitoring
Redis cache hit/miss ratios
Rate limiting effectiveness tracking

Security Testing & Validation

Implemented Security Tests

Authentication flow validation
Authorization bypass attempts
Rate limiting effectiveness
Token manipulation testing
SQL injection prevention
XSS attack prevention

Security Headers Validation

# Security header verification
curl -I https://api.randhana.com/secureauth/health

HTTP/1.1 200 OK
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

Skills Demonstrated

Backend Engineering

RESTful API design and implementation
Database design and optimization
Caching strategies and implementation
Error handling and logging

Security Engineering

Threat modeling and risk assessment
Secure authentication and authorization
Security header implementation
Audit logging and monitoring

DevOps & Deployment

Containerization with Docker
CI/CD pipeline implementation
Production deployment automation
Infrastructure as code practices

Code Quality

TypeScript for type safety
Clean architecture principles
Comprehensive error handling
Security-first development approach

API Documentation

Documentation: https://api.randhana.com/secureauth/api-docs/

Authentication Endpoints

# User registration
POST /auth/register
Content-Type: application/json
{
  "email": "[email protected]",
  "password": "SecurePass123!",
  "name": "John Doe"
}

# User login
POST /auth/login
Content-Type: application/json
{
  "email": "[email protected]",
  "password": "SecurePass123!"
}

# Token refresh
POST /auth/refresh
Content-Type: application/json
{
  "refreshToken": "your_refresh_token"
}

# User profile (requires authentication)
GET /auth/profile
Authorization: Bearer your_jwt_token

Admin Endpoints (RBAC Protected)

# List all users (admin only)
GET /admin/users
Authorization: Bearer admin_jwt_token

# User management (admin only)
PUT /admin/users/:id
Authorization: Bearer admin_jwt_token

Conclusion

This authentication API demonstrates enterprise-grade security implementation, production-ready architecture, and comprehensive DevOps practices. The system is designed to handle real-world security threats while maintaining high performance and scalability.