Middleware

Relevant source files

The following files were used as context for generating this wiki page:

• BACKEND/src/app.js
• BACKEND/src/routes/user.routes.js
• BACKEND/src/models/User.model.js
• BACKEND/package.json
• frontend/front/src/services/api.js

Middleware in this project serves as the intermediate processing layer between incoming HTTP requests and the final route handlers. It is utilized for security, request parsing, session management, and rate limiting to ensure the backend remains robust and secure.

The middleware stack is primarily configured in the Express application setup and applied selectively to specific routes, particularly those requiring authentication or protection against brute-force attacks.

Core Application Middleware

The application utilizes several standard and third-party middleware components to handle request lifecycles and security headers.

Global Configuration

The global middleware is registered in the main application file to affect all incoming requests.

Middleware	Description	Configuration/Source
CORS	Enables Cross-Origin Resource Sharing for all origins with credentials.	cors({ origin: '*', credentials: true })
JSON Parser	Parses incoming requests with JSON payloads, limited to 16kb.	express.json({ limit: "16kb" })
URL Encoder	Parses URL-encoded bodies with extended syntax, limited to 16kb.	express.urlencoded({ extended: true, limit: "16kb" })
Static	Serves static files from the "public" directory.	express.static("public")
Cookie Parser	Parses Cookie headers and populates req.cookies.	cookieParser()
Lusca	Provides application security middleware (CSRF, X-Frame-Options, etc.).	lusca()

Sources: BACKEND/src/app.js:12-25, BACKEND/package.json:30-41

Middleware Flow Diagram

This diagram illustrates how a request passes through the global middleware stack before reaching the API routes.

The flow ensures that every request is sanitized, parsed, and checked for security headers before logic execution. Sources: BACKEND/src/app.js:12-34

Security and Authentication Middleware

The system employs specialized middleware for protecting sensitive endpoints and managing user traffic.

JWT Verification

Authentication is handled via JSON Web Tokens (JWT). While the specific implementation of verifyJWT is referenced in the routes, its integration is a critical gatekeeper for secured actions such as logging out.

• Functionality: Validates the access token provided in the request headers or cookies.
• Usage: Applied to the /logout route to ensure only authenticated users can terminate their session.

Sources: BACKEND/src/routes/user.routes.js:27, BACKEND/src/models/User.model.js:52-78

Rate Limiting

To prevent abuse and brute-force attacks, the express-rate-limit middleware is implemented on specific user-related routes.

Limiter Instance	Target Route	Constraints
registerRateLimiter	/register	Max 100 requests per 15 minutes per IP.
logoutRateLimiter	/logout	Max 100 requests per 15 minutes per IP.

Sources: BACKEND/src/routes/user.routes.js:7-21

Authentication Sequence

The following sequence diagram shows how the frontend interacts with authenticated routes via middleware.

Model-Level Middleware (Hooks)

In addition to request-level middleware, the project uses Mongoose "pre" hooks as database-level middleware to handle data logic automatically before persistence.

Password Hashing

The User model employs a pre("save") hook to intercept user creation or password updates.

• Logic: Checks if the password field is modified.
• Action: Hashes the plain-text password using bcrypt with a salt round of 10.
• Result: Ensures that plain-text passwords are never stored in the database.

Sources: BACKEND/src/models/User.model.js:46-51

Client-Side Middleware (Interceptors)

The frontend utilizes Axios interceptors which act as middleware for outgoing requests.

Request Interceptor

Located in the API service layer, this interceptor automatically injects authentication credentials into every request if a token exists in the local storage.

// frontend/front/src/services/api.js
api.interceptors.request.use((config) => {
  const token = localStorage.getItem("token");
  if (token) {
    config.headers.Authorization = `Bearer ${token}`;
  }
  return config;
});

Sources: frontend/front/src/services/api.js:14-21

Summary

Middleware in the EICHackathon project creates a multi-layered defense and processing system. At the application level, it handles parsing and cross-origin policies. At the route level, it enforces rate limits and JWT authentication. Finally, at the data level, it ensures security through automated password hashing. This structured approach centralizes cross-cutting concerns, making the core business logic cleaner and more secure.