Improving security through authentication

[kerimhudson]

Problem

Our current setup of this application includes hardcoded authentication on our front-end and no authentication on our back-end endpoints. This leaves our data open to public visibility, which contains personal information (Names and Email addresses).

In order to fix this, we should implement some level of security on API backend and an improved method of authentication on the front-end to ensure that the password for administration cannot be retrieved from the front-end, and that our api endpoints can't be hit without authentication.

Solution

The easiest implementation of a solution with the current setup of our APIs would be to introduce a JWT Token requirement for the backend authentication.

1. Admin logs into the frontend
2. If successful login, a JWT token is generated (expires in 15mins? TBC.)
3. JWT token is passed as a parameter within requests (/:token/cities), to make minimals changes to the API.
4. If JWT is invalid (or has expired), the request is blocked as forbidden, else the data is passed back to the client