Node.js authentication can be challenging, especially when using JSON Web Tokens (JWT). Here's an example of handling node.js authentication problems with jwt:

Firstly, you need to install jsonwebtoken and bcrypt modules in your project. You can use the following command to install:

npm install jsonwebtoken bcryptjs

Next, let's create a login route:

app.post('/login', (req, res) => {
  // check if user exists in db
  const user = getUserByEmail(req.body.email);

  if (!user || !bcrypt.compareSync(req.body.password, user.password)) {
    return res.status(401).send({ message: 'Invalid credentials' });
  }

  // create a jwt token with user id as payload
  const token = jwt.sign({ id: user._id }, process.env.JWT_SECRET);

  res.send({ token, user });
});

In this code, we first check if the user exists in our database by their email. If not, we return a 401 status code and an error message. If the user does exist, we use bcrypt to compare the input password with the hashed password in the database. If they don't match, we return a 401 status code and an error message.

If both checks pass, we generate a JWT token using jwt.sign() function. The payload of this token is our user's id. The secret key used to sign the token is stored in the environment variable JWT_SECRET. This secret key should be kept secure and not exposed.

Finally, we send back the token as a response along with some additional data about the user (for example, their username or email).

On the client side, you can then use this token to authenticate your requests by including it in the Authorization header:

fetch('/api/protected', {
  headers: {
    Authorization: `Bearer ${token}`,
  },
});

In the server, you can extract this token from the request headers and verify its authenticity using jwt.verify() function. If the token is valid, you can grant access to the protected route by calling next(). If it's not valid, you can return a 401 status code:

app.use('/api/protected', (req, res, next) => {
  const token = req.headers['authorization']?.replace('Bearer ', '');

  if (!token) {
    return res.status(401).send({ message: 'Unauthorized' });
  }

  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.userId = decoded.id;
    next();
  } catch (error) {
    return res.status(401).send({ message: 'Unauthorized' });
  }
});

In this code, we extract the token from the request headers and remove the 'Bearer ' prefix if it exists. If there's no token in the request, we return a 401 status code.

If there is a token, we try to verify it using jwt.verify() function with our secret key. If the verification succeeds, we set the decoded user id as a property on the request object and call next(). If the verification fails, we return a 401 status code.