How can I secure my Node.js backend api data?

Question

I may be a little confused about how backend servers work. Let's say I have a frontend React app with a login. The login information is stored in a database (i.e. MSSQL, MySQL, MongoDB) and I have a Node backend with routes for my app to fetch that information when a user is logging in or doing anything. When both my React app and server are hosted, I would make calls to the api and no confidential information (such as passwords) would be sent back to the client (just maybe a "success" message if the login information appears to be correct on the backend). My question is, what is stopping someone from finding the backend route and putting it into Insomnia to get the password or other sensitive information?

My first thought was to use express-session and auth on the backend to require a user to be logged in to an account to make such requests, but I think there are two issues with that:

1. How will that work when multiple users are logging in at once? Since the users are not technically physically visiting the api routes themselves, does session still know who is signing in to what account on the frontend? Will the second person logging in override the first person's session even though the first hasn't logged out yet?
2. If the auth doesn't kick in until a person is logged in, wouldn't someone be able to get the response password data from the login route itself?

Sorry if the question sounds dumb I'm just having a little trouble understanding the security aspect.

Answer 1

It sounds like there's a bit of a misunderstanding of how auth sessions work. There are two primary way sessions can work - either storing the sessions on the backend (older way), or storing session data in a cookie, typically a JWT (JSON Web Token). Cookies are bits of data that are passed from the server to the browser and anytime the browser makes a subsequent request to your server, it passes the cookie back too, so your server will always be able to get that data. The way this works for auth is the following:

1. A user signs into your application with credentials (username and password).
2. Your server validates the credentials by checking your database or wherever you're storing them and rejects the request if it fails. (Check out Auth0, Firebase Auth, or other auth services as doing this yourself can be a pain and open yourself up to potential vulnerabilities)
3. If the credentials are valid, the server generates a signed JWT token that includes data, like the username of the user.
4. The server responds with the body as well as a cookie containing the JWT, which the browser then stores.
5. The user requests some user-specific data from your server, and the browser sends the cookie with the JWT back to your server.
6. Your server validates that the JWT is valid by checking the signature. If it is valid, it uses the username from the token to get the user-specific data. If it is not valid, it rejects the request.

Because the signature occurs entirely on the server side (typically with some hashing algorithm and a secret key that you don't vend publicly), it would be nearly impossible for someone to spoof a JWT token signature. Therefor, your server is able to 1. trust that the JWT token is indeed valid if the signature is correct, and 2. find out what user is requesting data.

Here's a video that helps explain and visualize this: https://www.youtube.com/watch?v=soGRyl9ztjI

And here's a library for creating and validating JWTs in Node: https://www.npmjs.com/package/jsonwebtoken

Hopefully that answers your question!