Mern Auth Template

Core System Architecture The application is split into two independent runtimes: a backend folder exposing an Express.js API on http://localhost:5000/api and a frontend folder serving a React SPA on http://localhost:3000. The backend uses Mongoose models to interact with MongoDB, while the frontend consumes the API through Axios calls wrapped in a Context API for global auth state.

Data Ingestion & Persistence User registration triggers a controller that validates input, hashes the password with bcrypt, stores the user document, and sends a verification email via Nodemailer. Password reset flows generate a one‑time OTP stored temporarily in the user record and emailed to the user. All mutable operations are protected by rate limiting and Helmet headers to mitigate abuse.

Execution Flow Authentication routes (/register, /login, /logout, /send-verify-otp, /verify-account, /reset-password) are defined in server/routes/authRoutes.js and guarded by the userAuth middleware where needed. After successful login, a JWT is issued and stored in an HTTP‑only cookie, enabling the protected /profile and /data endpoints to verify the user via the isAuthenticated controller.

Security Guardrails The stack employs input sanitization, Joi schema validation (as referenced in project learnings), rate limiting, and Helmet for HTTP security headers. Tokens are kept in HTTP‑only cookies to prevent XSS, and all password handling uses salted hashing. Email verification and OTP checks add an extra layer of identity assurance.

Build & Deployment Topology Development scripts run the backend with npm run dev (nodemon) and the frontend with npm start (Vite). Environment variables are managed via .env files in each folder, separating concerns for database URIs, JWT secrets, SMTP credentials, and client URLs. The codebase is linted with ESLint to enforce code quality across both sides.