Build an Authentication System from Scratch

Overview

Most developers use auth libraries without understanding what happens underneath. In this tutorial, you'll build a complete authentication system from scratch — email/password registration, login, JWT access and refresh tokens, bcrypt password hashing, protected route middleware, and session management.

What you'll learn:

How password hashing works (bcrypt salting and rounds)
JWT structure, signing, and verification
Access token vs refresh token patterns
Middleware-based route protection
Secure cookie handling and session invalidation
Common auth vulnerabilities and how to prevent them

We'll use Express, bcrypt, jsonwebtoken, and a SQLite database (via better-sqlite3) to keep the focus on auth logic rather than infrastructure.

Step 1: Project Setup

Create tsconfig.json:

Create your entry point at src/index.ts:

Step 2: Database Schema

Create src/db.ts. We store users with hashed passwords and a separate table for refresh tokens so we can revoke sessions.

The key design decisions: passwords are never stored in plain text, refresh tokens are hashed in the database (so a database leak doesn't compromise active sessions), and tokens can be individually revoked.

Step 3: Password Hashing with Bcrypt

Create src/auth/password.ts:

Bcrypt is specifically designed for password hashing. Unlike SHA-256, it's intentionally slow — each hash takes ~250ms at 12 rounds. This makes brute-force attacks impractical. The salt is embedded in the hash output, so you never need to store it separately.

Why 12 rounds? It's the current recommended minimum. Each additional round doubles the computation time. At 12 rounds, hashing takes roughly 250ms — fast enough for login, slow enough to deter attackers.

Step 4: JWT Token Generation

Create src/auth/tokens.ts:

Two tokens serve different purposes. The access token is short-lived (15 minutes) and sent with every API request. The refresh token is long-lived (7 days), stored in an HTTP-only cookie, and used only to get new access tokens. This limits the damage window if an access token is stolen.

Step 5: User Registration

Create src/routes/auth.ts:

Notice the refresh token cookie configuration: httpOnly prevents JavaScript access (XSS protection), secure ensures HTTPS-only in production, sameSite: strict prevents CSRF, and path restricts where the cookie is sent.

Step 6: Login Endpoint

Add the login route to src/routes/auth.ts:

The timing attack defense is critical. When a user doesn't exist, we still hash a dummy password so the response time is identical to a failed password check. Without this, an attacker can enumerate valid emails by measuring response times.

Step 7: Token Refresh Endpoint

Step 8: Auth Middleware

Create src/middleware/authenticate.ts:

Step 9: Protected Routes

Create src/routes/protected.ts:

Every route on protectedRouter runs through the authenticate middleware first. The middleware extracts the JWT from the Authorization header, verifies it, and attaches the user payload to the request object.

Step 10: Logout and Security Hardening

Add logout to src/routes/auth.ts:

Test the full flow:

Security checklist before deploying:

Replace hardcoded secrets with environment variables
Add rate limiting to /auth/login and /auth/register (express-rate-limit)
Add input sanitization with a validation library
Enable HTTPS in production
Add CORS configuration
Set security headers (helmet middleware)
Add account lockout after N failed login attempts
Log authentication events for audit trails

You now understand every layer of an auth system — from raw passwords to hashed storage, from token generation to middleware verification. When you use a library like NextAuth or Passport, you'll know exactly what it's doing under the hood.