Perancangan Middleware Modular Autentikasi dan Hak Akses pada RESTFUL API Node.js (Studi Kasus Aplikasi Insightku)

Abstract

Keamanan sistem RESTful API menjadi perhatian penting seiring meningkatnya penggunaan arsitektur layanan web pada aplikasi modern. Penelitian ini merancang dan mengimplementasikan enam middleware modular untuk autentikasi dan hak akses pada RESTful API berbasis Node.js dengan studi kasus aplikasi manajemen keuangan Insightku. Analisis awal menemukan sepuluh permasalahan, termasuk ketiadaan Role-Based Access Control (RBAC), duplikasi middleware authenticateToken sebanyak 18 kali, tidak adanya proteksi brute force, validasi input terpusat, dan audit trail. Menggunakan metode Research and Development (R&D) dengan model ADDIE serta pengujian Black Box Testing, dikembangkan enam middleware: authenticateToken, checkRole, errorHandler, rateLimiter, validateRequest, dan requestLogger. Pengujian pada 14 skenario menunjukkan tingkat keberhasilan 100% dengan overhead response time 2–22 ms. Duplikasi kode berkurang 94,4% dan solusi yang dikembangkan mampu memitigasi 9 dari 10 ancaman OWASP API Security Top 10. Validasi menghasilkan skor rata-rata 4,67/5,00 (Sangat Baik).

The security of RESTful API systems has become increasingly important with the growing adoption of web service architectures in modern applications. This study designs and implements six modular middlewares for authentication and access control in a Node.js-based RESTful API, using the Insightku personal finance application as a case study. Initial analysis identified ten issues, including the absence of Role-Based Access Control (RBAC), 18 duplicated authenticateToken middleware instances, and the lack of brute force protection, centralized input validation, and audit trails. Using the Research and Development (R&D) methodology with the ADDIE model and Black Box Testing, six middlewares were developed: authenticateToken, checkRole, errorHandler, rateLimiter, validateRequest, and requestLogger. Testing across 14 scenarios achieved a 100% success rate with a response time overhead of 2–22 ms. Code duplication was reduced by 94.4%, and the solution mitigates 9 of the 10 OWASP API Security Top 10 threats. Validation resulted in an average score of 4.67/5.00 (Very Good).