Securing API Routes: Basic Authentication Explained

Learn how to protect API roots using basic authentication with username & password! Secure your database and prevent data breaches with Bcrypt. Watch now!

For additional learning materials and updates:
- Follow me on Twitter: https://twitter.com/dolearning
- Sign up for my newsletter: https://kevincunningham.co.uk/newsletter
- Find all the code for this video here: https://github.com/doingandlearning/building-an-api/tree/fourth-video

This video demonstrates how to protect API routes using Basic Authentication (basic auth) with a username and password. The process involves encoding the email (used as username) and password through Postman's basic auth authorization tab. The backend API receives the authorization header with a "Basic" prefix and a base64-encoded string. The backend then needs to do the following:

1. Store the password securely in the database.
2. Check if there's an authorization header that begins with "Basic" and has the encoded string.
3. Decode the string, separate the email and password, and check if there's a user with that email in the database.
4. Compare the sent password with the password in the database.
5. If everything is successful, the user can access the protected route; otherwise, return a 401 unauthorized header.

The implementation involves updating the user model to have a password field, then hashing the passwords using a library called Bcrypt. The hashed passwords are then stored in the database alongside a generated salt to further enhance security.

In addition to implementing Basic Auth middleware, the video also highlights the importance of not sending back the password field when requesting users. To fix this, the select attribute in the password field of the model is set to false.

However, using Basic Auth with HTTP can have potential security risks, such as interception by malicious users on the network. To mitigate these risks, HTTPS is recommended, and future videos will explore JSON web tokens (JWTS) as another layer of protection.

00:00 Introduction
00:34 Basic Authentication
02:19 Password Hashing
04:29 Mongoose Hooks
07:42 Protecting Routes
11:38 Middleware Functions
15:36 Compare Password
18:46 Selective Middleware Application