What authentication/authorization methods do you use in your current project?

The current project uses the following methods for authentication and authorization:

• JWT (JSON Web Tokens): for stateless authentication. After successful login, the user receives a token that is sent in request headers to verify permissions.
• OAuth 2.0: for integration with external services and social networks, allowing users to log in via Google, Facebook, and others.
• Role- and permission-based authorization (RBAC): access to actions and resources is determined based on the user's roles.
• Password storage: using bcrypt for secure hashing.

Example of JWT verification in Express.js:

const jwt = require('jsonwebtoken');

function authMiddleware(req, res, next) {
  const token = req.headers['authorization']?.split(' ')[1];
  if (!token) return res.status(401).send('Access denied');

  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = decoded;
    next();
  } catch (err) {
    res.status(400).send('Invalid token');
  }
}

This approach ensures security and flexibility in managing user access.