🔒 JWT Authentication

1-B   2-B   3-B   4-B  |  5 = Authorization   6 = expires   7 = const hashed=await bcrypt.hash(password,10); await User.create({email,password:hashed});   8 = const valid=await bcrypt.compare(password,user.password); if(!valid)return res.status(401).json({error:'Invalid'}); const token=jwt.sign({id:user._id},process.env.JWT_SECRET,{expiresIn:'7d'});   9 = Because the stored password is a one-way bcrypt hash, not the original text — bcrypt.compare() re-hashes the input with the same salt and checks equality; a plain === would never match a hash to raw text  |  10 = function protect(req,res,next){const token=req.headers.authorization?.split(' ')[1];if(!token)return res.status(401).json({error:'No token'});try{req.user=jwt.verify(token,process.env.JWT_SECRET);next();}catch{res.status(401).json({error:'Invalid'});}} then app.get('/api/profile',protect,(req,res)=>res.json(req.user));