backend/
middleware/
Auth guard, rate limits, and upload handling.
The guard reads the jwt cookie first and falls back to the Authorization
header — that fallback is what makes hosted frontends work where
third-party cookies are blocked. Limits range from 15 auth attempts per 15
minutes to 60 searches per 5 minutes. Uploads pick Cloudinary storage when
keys exist and local disk otherwise, cap files at 10MB, and convert Multer
errors into 400 responses instead of crashes.
What it owns
- Token verification and user loading for protected routes
- Per-area request rate limits
- Multer uploaders: avatar, cover, post image, documents
Files
File list and purposes from the folder README.
| File | Purpose |
|---|---|
authMiddleware.js | Cookie-or-Bearer token check, loads the user. |
rateLimiter.js | Five limiters for auth, connections, search, posts, jobs. |
upload.js | Cloudinary-or-local storage plus error wrapping. |
Dependencies
| Library | Version range | Why it is used here |
|---|---|---|
| dotenv | ^16.5.0 | First line of index.js. |
| Socket.io Redis adapter | ^8.3.0 | Attached to the io server in utils/socket.js when pub/sub are ready. |
| ioredis | ^5.11.1 | Presence hash plus the pub/sub pair in config/redis.js. |
| Socket.io | ^4.7.4 | Server, rooms, and event handlers in utils/socket.js. |
| cookie-parser | ^1.4.7 | Cookie parsing in index.js, read by authMiddleware. |
| cors | ^2.8.5 | Permissive CORS in index.js and utils/socket.js. |
| Express | ^5.1.0 | App, router mounting, and static uploads in index.js. |
| express-rate-limit | ^8.5.2 | Auth, connection, search, post, and job limiters in middleware/rateLimiter.js. |
| Mongoose | ^8.14.1 | All six models plus the database.js connector. |
| Cloudinary | ^1.41.3 | Configuration in config/cloudinary.js; upload targets in middleware/upload.js. |
| Multer | ^2.0.1 | Avatar, post, cover, and document uploaders in middleware/upload.js. |
| multer-storage-cloudinary | ^4.0.0 | Cloud storage engines in middleware/upload.js. |
| Nodemailer | ^9.0.3 | Admin plus confirmation mails in contactController.js. |
| bcryptjs | ^2.4.3 | Pre-save hash and password check in models/User.js. |
| better-authDeclared but not used in source | ^1.6.23 | Declared in both manifests but never imported in any source file; authentication is JWT plus bcrypt. |
| jsonwebtoken | ^9.0.2 | Token issue in userController and authController; verified in authMiddleware. |
| validator | ^13.11.0 | Field validation in models/User.js. |
Dependencies as of commit cdef8af.
Laying out Backend middleware folder…
BrowserAPIRealtimeCacheDatabaseShareddurableephemeral
Talks to
Sources: backend/middleware/authMiddleware.js, backend/middleware/rateLimiter.js, backend/middleware/upload.js (documented at commit cdef8af)