The InstaMERN backend API powers the InstaMERN application, a full-stack social media platform similar to Instagram. This API allows users to register, log in, create posts & story, add comments, follow & unfollow, AWS Cloud Computing for storage & sending emals and more.
The InstaMERN backend leverages AWS Cloud Services for various functionalities. Here are the AWS services used:
-
Amazon S3
Description: Amazon S3 is used for storing and serving user-uploaded images, including post images, story images and profile pictures.
-
Amazon SES
Decription: Amazon SES is used for sending emails to users in order to reset passwords & emails by secure token.
- Signup & login with secure token
- Uploading posts/stories to AWS Cloud & load them from MongoDB
- Sending reset links to users' email address with AWS SES to reset & update their password
- Structured users' data more secure with mongoose Data Modelling both referencing & embedded
- Encrypting & hashing passwords
- Email validator via both backend API & AWS Cloud
- Verifying JSON Web Token
- Security HTTP headers with helmet
- Rate limitting from the same IP/API
- Data Sanitization against NoSQL injection
- Data Sanitization against XSS
- Maganing & catching errors globally with middleware functions
- Generate expired token
- Sending JWT via cokie
- Restrict/protect some features by secure token
- Dedicate environments to development and production
Authentication is the process of verifying the identity of a user or system. In the context of a back-end application, it ensures that only authorized users can access protected resources. Here are some key considerations for implementing authentication:
Implement a user registration process that collects necessary information, such as username, email, and password. Ensure that password requirements, such as length and complexity, are enforced.
Provide a secure login mechanism using sessions or tokens. Validate user credentials against stored data and generate authentication tokens or session cookies for subsequent requests.
Authorization determines what actions a user can perform within an application. It ensures that authenticated users have the necessary permissions to access or modify specific resources. Consider the following when implementing authorization
Implement role-based access control (RBAC) to assign different permissions to different user roles. For example, an administrator role might have more privileges than a regular user role.
Control access to specific resources based on user roles and ownership. Ensure that users can only access resources they are authorized to view or modify.
Maintaining the security of your application is crucial to protect user data and prevent unauthorized access or data breaches. Consider the following security measures
Store user passwords securely by hashing them with a strong cryptographic algorithm like bcrypt or Argon2. Hashing passwords prevents storing plain-text passwords in the database, making it harder for attackers to retrieve user passwords in case of a data breach.
Enable secure communication between clients and the server using HTTPS/TLS. This ensures that data transmitted over the network is encrypted and protects against eavesdropping and tampering. Obtain and install an SSL certificate to enable HTTPS on your server.
Implement secure session management to track user sessions and prevent session-related attacks such as session hijacking or fixation. Use secure session storage mechanisms, such as server-side storage or encrypted client-side storage (e.g., signed cookies), and regenerate session IDs after user authentication or privilege changes.
Sotarage users' materials suchs as posts, profile pictures, stories in AWS Cloud Object Storage
POST /instamern/users/signup: Register a new user.
POST /instamern/users/login: Log in an existing user.
GET /instamern/users/username/:username: Get user profile by username.
GET /instamern/users/authorization/current-user: Get currently logged-in user by secure token.
GET /instamern/posts: Get all posts.
GET /instamern/posts/:id: Get a single post by ID.
POST /instamern/posts/upload: Create a new post by secure token and storage it to AWS Cloud
POST /instamern/posts/like/:id: Like a post by current user's secure token.
POST /instamern/posts/comment/:id: Add a comment to a post by current user's secure token.
DELETE /instamern/posts/delete/:id: Delete a post by current user's secure token.
GET /instamern/stories: Get all stories.
POST /instamern/stories/upload: Add a new story by current user's secure token and save it to AWS Cloud
