Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve MongoDB Connection, Token Authentication, and Error Handling Consistency #1086

Open
smog-root opened this issue Oct 26, 2024 · 1 comment

Comments

@smog-root
Copy link

smog-root commented Oct 26, 2024

Currently, there are some improvements that can be made to enhance security, consistency, and maintainability across the server:
Suggested Changes:

MongoDB Connection:

  • Update the MongoDB connection string to use an environment variable (process.env.MONGO_URI) instead of a hardcoded string. This allows for easier configuration and enhanced security.

Token Authentication:

  • Update JWT_secret to process.env.JWT_SECRET in the authenticateToken middleware for consistency and improved security.

  • Modify token handling in authenticateToken to provide more descriptive and standardized responses:

  • Return a 401 status code with a message like "Access denied. No token provided" if the token is missing.

  • Return a 403 status code with a message like "Invalid token" if token verification fails.

Error Handling Consistency:

  • Implement a centralized error handler to standardize error responses. This will eliminate repetitive error handling code and ensure that errors are handled consistently.

Example error handler: 🔽

app.use((err, req, res, next) => {
  res.status(500).json({ error: "An internal server error occurred" });
});

Add gssoc-ext with level and hacktoberfest-accepted labels @mansiruhil13

Copy link

🙌 Thank you for bringing this issue to our attention! We appreciate your input and will investigate it as soon as possible !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant