Elebase: Proxy and JWT Auth

Elebase’s Elemap viewer used to be a pure client-side Vue application I developed to the client’s specification. The project grew to a multiuser with editing functionality so eventually the need for authentication and authorization, as well as a view count limit enforcement emerged.

Server side handling was necessary as all auth config sat in a global project in Elebase. I implemented an Express.js based proxy to sit in front of the original Elebase API to take care of that.

The proxy authorizes CORS origin, checks that a project is active and has valid credentials, checks that monthly quota is not exceeded, and then proxies requests to Elebase using server-side credentials. It also features IP rate limiting, response obscuring via a env flag, and a slug-uniqueness check endpoint.

For write requests (editing an authenticated user’s project), a full JWT authentication system was implemented with email and password credentials that are forwarded to Elebase via a HMAC-signed request. Edits are authorized using the project ID, so a token cannot be used to edit other projects.

View analytics were originally implemented via the proxy (post-response handling) but that was moved to the minimal analytics service Goatcounter to take advantage of a fuller package and not put so much burden to the Elebase DB.