Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/nelrondon/backend-proyecto-estructuras/llms.txt

Use this file to discover all available pages before exploring further.

The Estructuras Backend API uses JSON Web Tokens (JWT) to authenticate users. When a user registers or logs in successfully, the server signs a JWT and delivers it to the client exclusively through an HTTP-only cookie named token. Because the cookie is never exposed to JavaScript, it is immune to XSS-based token theft. All subsequent requests to protected routes automatically carry the cookie, and the authRequired middleware silently validates it on the server before any handler runs.

​
How the Token Is Issued

On a successful POST /api/register or POST /api/login, the server calls createAccessToken({ id: user.id }), which signs a JWT with the application’s SECRET_KEY and a 7-day expiry. The resulting token is written into the response cookie with the following settings:
Cookie attributeValuePurpose
httpOnlytruePrevents JavaScript from reading the cookie
securetrueTransmits the cookie over HTTPS only
sameSite'none'Allows cross-site requests (required for separate front-end/back-end deployments)
maxAge604 800 000 ms (7 days)Defines the cookie lifetime
Because sameSite is set to 'none', the secure flag is mandatory — browsers will reject a sameSite: none cookie that is not also marked secure.

​
The authRequired Middleware

Protected routes are guarded by the authRequired middleware defined in src/middlewares/validateToken.js. On every request it:
  1. Reads req.cookies.token.
  2. Returns 401 with { message: "No Token, Unauthorized" } if no cookie is present.
  3. Calls jwt.verify(token, SECRET_KEY) — returns 403 with { message: "Invalid Token" } if the token is expired or tampered with.
  4. Attaches the decoded payload (which contains id) to req.user and calls next() on success.

​
Auth Endpoints

MethodPathProtectedDescription
POST/api/registerNoCreate a new user account
POST/api/loginNoAuthenticate and receive a token cookie
POST/api/logoutNoClear the token cookie and end the session
GET/api/YesFetch the currently authenticated user’s profile
GET/api/verify-tokenYesValidate the active session and return user data

​
Public vs. Protected Routes

Public routes — /api/register, /api/login, and /api/logout — do not require a token. Any client can call them freely. Protected routes — GET /api/ and GET /api/verify-token — are wrapped by the authRequired middleware. A request that arrives without a valid token cookie is rejected before it ever reaches the controller.

​
Browser (Fetch API)

Cross-origin browser requests must include credentials: 'include' so the browser attaches the cookie automatically: 
const response = await fetch('https://your-api.com/api/verify-token', {
  method: 'GET',
  credentials: 'include',
});
const data = await response.json();

​
curl

Use -c to save cookies to a file after login and -b to re-send them on subsequent requests: 
# Save the cookie on login
curl -c cookies.txt -s -X POST https://your-api.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":"johndoe","password":"secret123"}'

# Use the saved cookie on a protected route
curl -b cookies.txt -s https://your-api.com/api/verify-token

​
Auth Pages

Register

Create a new user account with POST /api/register.

Login

Authenticate with username and password via POST /api/login.

Logout

Clear the session cookie with POST /api/logout.

Verify Token

Validate an active session with GET /api/verify-token.

Build docs developers (and LLMs) love

Get started for freeTalk to us