TRUEAUTH

Biometric Authentication Prototype · Firebase · JWT · PostgreSQL

TrueAuth is a proof-of-concept authentication system integrating:

• Firebase Authentication for identity verification
• Client-side facial recognition using face-api.js
• Express backend issuing application-level JWT tokens
• PostgreSQL for persistent user storage

The system demonstrates hybrid authentication combining third-party identity verification with biometric enrollment and token-based authorization.

✔ Face-Based Registration & Login
✔ Firebase ID Token Verification
✔ JWT-Based Protected Routes
✔ PostgreSQL User Persistence
✔ Modular Backend Architecture

• React (Vite)
• face-api.js for facial detection & embeddings
• Firebase Client SDK
• Axios for API communication

• Node.js + Express
• firebase-admin for verifying Firebase tokens
• jsonwebtoken for issuing JWTs
• pg for PostgreSQL integration
• dotenv for environment configuration
• cors for cross-origin handling

TrueAuth/ │ ├── Backend/ │ ├── controllers/ │ ├── routes/ │ ├── index.js │ ├── serviceAccountKey.json │ └── .env │ └── Frontend/ ├── src/ ├── components/ ├── public/models/ └── vite.config.js

1. User authenticates via Firebase.
2. Firebase ID token is sent to backend.
3. Backend verifies token using firebase-admin.
4. Backend issues application-level JWT.
5. JWT grants access to protected routes.
6. Facial embedding is enrolled client-side.

Create .env inside Backend/:

PORT=4000 JWT_SECRET=your_strong_secret postgres_user=your_user postgres_host=localhost postgres_db=your_database postgres_password=your_password postgres_port=5432

Do not commit:

• .env
• serviceAccountKey.json

CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE TABLE users (
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
firebase_uid text NOT NULL UNIQUE,
name text NOT NULL,
email text NOT NULL UNIQUE,
face_embedding double precision[],
face_registered boolean DEFAULT false,
created_at timestamp without time zone DEFAULT now()
);

cd Backend
npm install
node index.js

cd Frontend
npm install
npm run dev

• 🔐 Use a strong JWT_SECRET
• 🚫 Never commit credentials
• 🌐 Use HTTPS in production
• 🚦 Add rate limiting before deployment
• 👁️ Biometric data must be handled with extreme caution in production systems

• Not production-hardened
• Limited abuse protection
• Intended for architectural experimentation

TrueAuth v1.0 — Biometric Authentication Prototype