[FEATURE] Implement Authentication and Authorization for the Backend #35

New issue

Closed

opened 2026-07-13 00:47:59 +00:00 by PoweredDeveloper · 0 comments

PoweredDeveloper commented

2026-07-13 00:47:59 +00:00

Owner

The Backend currently exposes its API without an authentication or authorization mechanism. This means protected endpoints cannot distinguish between authenticated users, administrators, or unauthenticated requests, making the service unsuitable for production use.

Describe the solution you'd like

Implement a secure authentication and authorization system for the Backend.

The implementation should include:

User authentication.
JWT-based access and refresh tokens.
Password hashing using a modern algorithm (e.g., Argon2 or bcrypt).
Authentication middleware/dependencies for protected endpoints.
Configurable token lifetime and signing secret via environment variables.
Proper HTTP status codes for authentication and authorization failures.

Describe alternatives you've considered

The Backend could rely solely on network isolation or reverse proxy restrictions. While this reduces external exposure, it does not provide application-level security or user-specific access control and is therefore insufficient for production deployments.

Additional context

This authentication system will secure the Backend API used by the web client, Telegram bot, and future services. It should be independent of the 3x-UI authentication mechanism while allowing integration with existing Backend user accounts and roles.

Checklist

I have checked that this feature is not already requested.
I am willing to help implement it (optional).

## Is your feature request related to a problem? The Backend currently exposes its API without an authentication or authorization mechanism. This means protected endpoints cannot distinguish between authenticated users, administrators, or unauthenticated requests, making the service unsuitable for production use. ## Describe the solution you'd like Implement a secure authentication and authorization system for the Backend. The implementation should include: * User authentication. * JWT-based access and refresh tokens. * Password hashing using a modern algorithm (e.g., Argon2 or bcrypt). * Authentication middleware/dependencies for protected endpoints. * Configurable token lifetime and signing secret via environment variables. * Proper HTTP status codes for authentication and authorization failures. ## Describe alternatives you've considered The Backend could rely solely on network isolation or reverse proxy restrictions. While this reduces external exposure, it does not provide application-level security or user-specific access control and is therefore insufficient for production deployments. ## Additional context This authentication system will secure the Backend API used by the web client, Telegram bot, and future services. It should be independent of the 3x-UI authentication mechanism while allowing integration with existing Backend user accounts and roles. ## Checklist * [ ] I have checked that this feature is not already requested. * [ ] I am willing to help implement it (optional).

PoweredDeveloper added this to the Sprint 1 milestone

2026-07-13 00:47:59 +00:00

PoweredDeveloper added the

backend

enhancement

labels

2026-07-13 00:47:59 +00:00