🔐 Fullstack Security Implementation

A comprehensive authentication and authorization dashboard featuring React.js frontend, Node.js backend, PostgreSQL database, JWT/OAuth2.0 authentication, and mTLS security.

✨ Features

🔒 Authentication & Authorization

JWT Authentication - Access & Refresh tokens with HTTP-only cookies
OAuth2.0 Integration - Google OAuth, Github OAuth and Keycloak support
Role-Based Access Control (RBAC) - Admin, Manager, and User roles
Mutual TLS (mTLS) - Certificate-based authentication for enhanced security

👥 User Management

User registration with email/password validation
Password hashing with bcrypt
Profile management
Session management with device tracking
Login activity logging

🛡️ Security Features

Rate limiting for brute force protection
Input validation and sanitization
Security headers with Helmet
CORS configuration
Suspicious activity detection
Failed login attempt monitoring

📊 Admin Dashboard

User management with advanced filtering
Bulk operations (status toggle, role assignment)
Analytics and charts
Audit log viewer
System health monitoring
User data export (JSON/CSV)

🛠️ Tech Stack

Layer	Technology
Frontend	React 19, React Router 7, Tailwind CSS 4, Vite 7
Backend	Node.js, Express.js, TypeScript
Database	PostgreSQL 15, Prisma ORM
Authentication	JWT, Passport.js, OAuth2.0
OAuth Server	Keycloak 25
Security	mTLS, bcrypt, Helmet
Containerization	Docker, Docker Compose

📁 Project Structure

fullstack-security-implementation/
├── backend/
│   ├── certs/                    # TLS certificates for mTLS
│   ├── prisma/
│   │   ├── migrations/           # Database migrations
│   │   ├── schema.prisma         # Database schema
│   │   └── seed.ts               # Database seeder
│   └── src/
│       ├── controllers/          # Route controllers
│       ├── middleware/           # Auth, RBAC, mTLS middleware
│       ├── routes/               # API routes
│       ├── types/                # TypeScript types
│       ├── utils/                # Utility functions
│       └── server.ts             # Express server
├── frontend/
│   └── src/
│       ├── components/           # React components
│       ├── context/              # Auth context provider
│       ├── pages/                # Page components
│       │   └── Dashboard/        # Dashboard pages
│       └── services/             # API service layer
├── docker/
│   ├── docker-compose.yml        # Docker services configuration
│   └── keycloak-init.sh          # Keycloak initialization script
└── implementation-plan.md        # Detailed implementation plan

🚀 Quick Start

Prerequisites

Node.js 18+
Yarn or npm
Docker & Docker Compose
PostgreSQL (or use Docker)

1. Clone the Repository

git clone <repository-url>
cd fullstack-security-implementation

2. Start Database Services

cd docker
docker-compose up -d postgres keycloak

3. Setup Backend

cd backend

# Install dependencies
yarn install

# Create environment file
cp .env.example .env

# Generate Prisma client
yarn prisma:generate

# Run database migrations
yarn prisma:migrate

# Seed the database (creates demo users)
yarn prisma:seed

# Start development server
yarn dev

4. Setup Frontend

cd frontend

# Install dependencies
yarn install

# Start development server
yarn dev

5. Access the Application

Frontend: http://localhost:5174
Backend API: http://localhost:5000
Keycloak Admin: http://localhost:8080 (admin/admin123)

🔑 Demo Credentials

Role	Email	Password
Admin	admin@example.com	Admin123!
Manager	manager@example.com	Manager123!
User	user@example.com	User123!

📡 API Endpoints

Authentication

Method	Endpoint	Description
POST	`/api/auth/register`	Register new user
POST	`/api/auth/login`	Login with email/password
POST	`/api/auth/logout`	Logout user
POST	`/api/auth/refresh`	Refresh access token
GET	`/api/auth/me`	Get current user
GET	`/api/auth/google`	Google OAuth login
GET	`/api/auth/keycloak`	Keycloak OAuth login

User Activity

Method	Endpoint	Description
GET	`/api/activity/my/history`	User's login history
GET	`/api/activity/my/sessions`	User's active sessions
DELETE	`/api/activity/my/sessions/:id`	Revoke specific session
POST	`/api/activity/my/sessions/revoke-all`	Revoke all other sessions
GET	`/api/activity/my/security`	User's security summary

Admin (Admin Only)

Method	Endpoint	Description
GET	`/api/admin/users`	List all users with filtering
GET	`/api/admin/dashboard`	Dashboard statistics
PUT	`/api/admin/users/:id/role`	Update user role
PUT	`/api/admin/users/:id/status`	Toggle user status
POST	`/api/admin/users/bulk-status`	Bulk status update
POST	`/api/admin/users/bulk-role`	Bulk role assignment
GET	`/api/admin/audit-logs`	Security audit logs
GET	`/api/admin/system-health`	System health overview
GET	`/api/admin/export`	Export user data

mTLS (Certificate Required)

Method	Endpoint	Description
GET	`/api/mtls/verify`	Verify client certificate
GET	`/api/mtls/info`	Get certificate info

🔐 mTLS Configuration

Generate Certificates

cd backend/certs
./generate-certs.sh

This generates:

ca.crt / ca.key - Certificate Authority
server.crt / server.key - Server certificate
client.crt / client.key - Client certificate
client.p12 - PKCS12 bundle for browser import

Enable mTLS

Set in .env:

MTLS_ENABLED=true
HTTPS_PORT=5443

🐳 Docker Deployment

Full Stack Deployment

cd docker
docker-compose --profile full up -d

Services Only (Database + Keycloak)

cd docker
docker-compose up -d

Environment Variables

Variable	Description	Default
`PORT`	HTTP port	5000
`HTTPS_PORT`	HTTPS port (mTLS)	5443
`DATABASE_URL`	PostgreSQL connection string	-
`JWT_ACCESS_SECRET`	JWT access token secret	-
`JWT_REFRESH_SECRET`	JWT refresh token secret	-
`GOOGLE_CLIENT_ID`	Google OAuth client ID	-
`GOOGLE_CLIENT_SECRET`	Google OAuth client secret	-
`KEYCLOAK_URL`	Keycloak server URL	http://localhost:8080
`KEYCLOAK_REALM`	Keycloak realm name	security-app
`KEYCLOAK_CLIENT_ID`	Keycloak client ID	security-app-client
`MTLS_ENABLED`	Enable mTLS	false

🎨 Dashboard Views

User Dashboard

Profile settings
Active sessions management
Security overview
Personal data

Manager Dashboard

User list view
Team statistics
Reports

Admin Dashboard

Full user management
Analytics and charts
Audit logs
System health monitoring
Role assignment
Bulk operations

🧪 Development

Backend Commands

yarn dev              # Start development server
yarn build            # Build for production
yarn start            # Start production server
yarn prisma:studio    # Open Prisma Studio
yarn prisma:migrate   # Run migrations
yarn prisma:seed      # Seed database

Frontend Commands

yarn dev              # Start development server
yarn build            # Build for production
yarn preview          # Preview production build
yarn lint             # Run ESLint

📝 Security Best Practices Implemented

✅ Password hashing with bcrypt (cost factor 12)
✅ JWT tokens with short expiry (15 min access, 7 day refresh)
✅ HTTP-only cookies for token storage
✅ CSRF protection
✅ Rate limiting (100 requests/15 min)
✅ Input validation and sanitization
✅ Security headers (Helmet)
✅ CORS configuration
✅ mTLS for certificate-based auth
✅ Audit logging
✅ Suspicious activity detection
✅ Brute force protection

📄 License

MIT License - see LICENSE for details.

🤝 Contributing

Fork the repository
Create your feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add amazing feature')
Push to the branch (git push origin feature/amazing-feature)
Open a Pull Request

📞 Support

For support, please open an issue in the repository.

Built with ❤️ for secure applications

Name		Name	Last commit message	Last commit date
backend		backend
docker		docker
frontend		frontend
README.md		README.md
architecture-idea.png		architecture-idea.png
implementation-plan.md		implementation-plan.md
project_technology_overview.md		project_technology_overview.md

Latest commit

History

Folders and files

Repository files navigation