I walk through protecting a Node/Express app with nginx basic auth, aimed at simple utilities on public servers: firewall off the app’s port so only nginx can reach it, configure nginx to proxy requests and require htpasswd credentials, and pass the authenticated username to the app via a request header. I also cover the approach’s limitations, such as plaintext passwords without SSL, no logout mechanism, and no brute-force protection...
While getting a web app ready for alpha testing with real user data, I needed to add login authentication. My post is mostly a recommendation for a video by Valentin Despa that explains the big picture of implementing authentication in an Express app with Passport, a gap left by more detailed tutorials...
