api-authentication

# API Authentication Implement secure authentication mechanisms for APIs using modern standards and best practices. ## Authentication Methods | Method | Use Case | Security Level | |--------|----------|----------------| | JWT | Stateless auth, SPAs | High | | OAuth 2.0 | Third-party integration | High | | API Keys | Service-to-service | Medium | | Session | Traditional web apps | High | ## JWT Implementation (Node.js) ```javascript const jwt = require('jsonwebtoken'); const generateTokens = (user) => ({ accessToken: jwt.sign( { userId: user.id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '15m' } ), refreshToken: jwt.sign( { userId: user.id, type: 'refresh' }, process.env.REFRESH_SECRET, { expiresIn: '7d' } ) }); const authMiddleware = (req, res, next) => { const authHeader = req.headers.authorization; // Validate authorization header format if (!authHeader || !authHeader.startsWith('Bearer ')) { return res.status(401).json({ error: 'Malformed authorization header' }); } const parts = authHeader.split(' '); if (parts.length !== 2) { return res.status(401).json({ error: 'Malformed authorization header' }); } const token = parts[1]; if (!token) { return res.status(401).json({ error: 'No token provided' }); } try { req.user = jwt.verify(token, process.env.JWT_SECRET); next(); } catch (err) { res.status(401).json({ error: 'Invalid token' }); } }; ``` ## Security Requirements ...