Authentication & Security
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The Authentication & Security system provides a robust framework for managing user identity and protecting system resources. It is primarily centered around the Node.js Auth & Orchestration Service, which handles user registration, secure login via JSON Web Tokens (JWT), and endpoint protection through middleware.
The system ensures per-user isolation for sensitive data such as conversations and memories, while implementing defensive measures like rate limiting and password hashing. This infrastructure allows the AI Assistant to maintain private user contexts across its multi-tier architecture.
Sources: README.md:14-23, Ai-Assistant-v2/auth-service/server.js:103-160
User Authentication Flow
Authentication is implemented using JWTs stored in HTTP-only cookies. This approach prevents client-side scripts from accessing the token, mitigating Cross-Site Scripting (XSS) risks.
Registration and Login
Users register by providing a unique username and a password. During login, the system verifies credentials against the MongoDB database. Upon successful verification, a JWT is signed with the user's ID and username, then sent to the client as a cookie.
The registration process enforces minimum length requirements for usernames (3 characters) and passwords (6 characters) to ensure basic account security.
Sources: Ai-Assistant-v2/auth-service/server.js:108-154, ai-assistant-react/src/components/Auth/Register.jsx:15-35
Password Security
Passwords are never stored in plain text. The User model utilizes a pre-save hook to hash passwords using bcryptjs with a salt factor of 10.
| Field | Type | Constraint | Description |
|---|---|---|---|
username | String | Unique, Required | The primary identifier for the user. |
password | String | Required | The hashed password string. |
createdAt | Date | Default: Now | Timestamp of account creation. |
Sources: Ai-Assistant-v2/auth-service/models/User.js:4-21, Ai-Assistant-v2/auth-service/server.js:33-47
Authorization and Middleware
Access control is enforced through specialized middleware that intercepts requests to protected routes.
JWT Verification Middleware
The authMiddleware is responsible for extracting and validating the JWT. It primarily looks for the token in the token cookie but supports a Bearer token in the Authorization header as a fallback.
If valid, the decoded user information (ID and username) is attached to req.user, allowing downstream route handlers to perform user-specific operations.
Sources: Ai-Assistant-v2/auth-service/middleware/auth.js:10-64, Ai-Assistant-v2/auth-service/routes/ai.js:19-25
Route Protection Examples
Routes handling AI chat, memory management, and user settings are wrapped with authentication and rate limiting.
// Example of protected AI chat route
apiRouter.post('/ai/chat', authMiddleware, chatLimiter, async (req, res) => {
// Only accessible if authMiddleware calls next()
const userId = req.user.userId;
// ... logic ...
});
Sources: Ai-Assistant-v2/auth-service/server.js:207-210, Ai-Assistant-v2/auth-service/routes/ai.js:19-21
Defensive Security Measures
Rate Limiting
The system implements express-rate-limit to prevent brute-force attacks and resource exhaustion. Different limits are applied based on the sensitivity and resource cost of the endpoint:
- Auth Limiter: Applied to login/register routes.
- Chat Limiter: Restricted to 5 requests per minute for AI operations.
- Memory Limiter: Applied to memory training and extraction tasks.
Sources: Ai-Assistant-v2/auth-service/server.js:9-11, README.md:167-167
CORS Protection
Cross-Origin Resource Sharing (CORS) is configured to only allow requests from specific trusted frontend origins (e.g., localhost ports 3000, 5173). The credentials: true setting is mandatory to allow the browser to send the HTTP-only auth cookies.
Sources: Ai-Assistant-v2/auth-service/server.js:17-21
Service Communication Security
When the Auth service communicates with the Python AI service, it uses internal REST calls. While these services run on different ports, security is maintained by ensuring sensitive environment variables (like JWT_SECRET and GEMINI_API_KEY) are managed via .env files and excluded from version control.
Sources: README.md:163-166, Ai-Assistant-v2/auth-service/server.js:14-15
Summary
The "Authentication & Security" module establishes a secure perimeter for the AI Assistant platform. By combining JWT-based sessions, HTTP-only cookies, bcrypt hashing, and multi-layered rate limiting, the system protects user data isolation and ensures the integrity of the conversational platform. All protected resources require a valid user context derived from the authMiddleware, ensuring that AI interactions and memories remain private to each authenticated user.