JWT Authentication for REST API Here is my code to implement authentication in a Node/Express/Sequelize project. This is my first time using JWT and I would appreciate any help!

// Load required packages
const jwt = require('jsonwebtoken');
const expressJwt = require('express-jwt');
const config = require('../config');
const User = require('../models').User;

exports.authenticate = function(req, res) {
  const username = req.body.username;
  const password = req.body.password;
  User.findOne({
    where: { username: username }
  }).then((user) =&gt; {
    // Make sure the password is correct
    if (user.verifyPassword(password)) {
      const token = jwt.sign({
        username: user.username
      }, config.jwtSecret);
      res.json({
        success: true,
        token: token,
        username: user.username
      });
    }
  }).catch((error) =&gt; {
    console.error(error);
    res.sendStatus(404);
  });
}

exports.isAuthenticated = expressJwt({ secret: config.jwtSecret });
Though not in Javascript, my uses of JWT have always used the password as the JWT secret.  The JWT payload is whatever you need to identify the user -- username in your case.  You can add in a CSRF token of some sort as well.  I have an example on my GitHub that is a very simple application using JWT as the authentication mechanism - https://github.com/dave-shawley/readings/blob/7d2504587daa6a174fc3cbc0a5478fa817412eea/readings/static/js/login.js#L10-L26 is the javascript login code.  Mind you that I am most certainly not a javascript programmer so don't read too much into my example for style advice ;)

My login code builds a JWT payload that looks something like:

{
  "exp": 1488027170,
  "iss": "https://whatever.example.com/login",
  "csrf": "123456ABCDEF",
  "nbf": 1488026870
}


where "nbf" is the current time, "exp" is the expiration time, and "iss" is the referring web site.  "csrf" is a one-time token that is embedded in the HTML form.

I encode this structure using the entered password as the secret and pass the resulting token to my login endpoint.  I have the user name in a secured cookie but it could be passed in the JWT payload as well.  On the receiving side, I look up the user information in my data store by the user name from the cookie.  Then I verify that the JWT payload was signed using the password as the secret and that it is still valid.  If everything checks out, then the user is authenticated.