
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
This is a Node.js module available through the npm registry.
Before installing, download and install Node.js. Node.js 0.10 or higher is required.
If this is a brand new project, make sure to create a package.json first with
the npm init command.
Installation is done using the
npm install command:
$ npm i auth-now
backend authentication just 3 stapes
Custom create user(email and password)
Custom login
Login with Google
Login with Facebook
Admin check
Get user info
Logout functionality
Dynamic Access Control Authentication(from v2)
Note:
mongoose corsis required for usingauth-now.
const {Schema,model} = require('mongoose');
const userSchema = new Schema({
name:{
type: 'string',
// require:[true,'Please Enter your Name '],
trim:true
},
email: {
type: 'string',
require:[true,'Please Enter your Email '],
trim: true
},
password: {
type: 'string',
},
role:{
type: Number,
default:0 // user:0,admin:1
},
avatar: {
type: String,
default: "" //you can add a default image
},
googleID:String,
facebookID:String,
provider:{
type:String,
default:'custom',
enum : ["custom", "google", "facebook"]
},
permissions:[{ //if you need to dynamically add permissions
type: String
}]
},{
timeStamp: true
})
module.exports = model('User',userSchema);
npm i mongoose // must install it
const app = require('express')();
const Auth = require('auth-now');
const auth = new Auth({
model:require('./models/user'),//add your model file location
googleClientID:process.env.GOOGLE_CLIENT_ID,
googleClientSecret:process.env.GOOGLE_CLIENT_SECRET,
facebookAppID:process.env.FACEBOOK_APP_ID,
facebookAppSecret:process.env.FACEBOOK_APP_SECRET ,
// accessTokenSecret,
// refreshTokenSecret,
expiresIn : {
refreshToken:'7d',
accessToken:'15m' //you can add it ('1s' or '1m' or '1h' or ' 1d )
}
})
app.use('/user',auth.router(app)); // This route name must be '/user'
//connect your database
app.listen(3000,()=>{
console.log(`server is running on port : 3000);
});
const {authUser,authAdmin,accessPermission} = auth
This middleware used to verify authenticated users.
This middleware used to verify the admin.(RBAC)
This middleware used to dynamic access control if permitted by admin.( Using 'userPermissionUpdate()' this function admin can update user access permissions form frontend.)
Again install the package in frontend
Note: again install the package in frontend.
import Auth from 'auth-now/client'
const auth = new Auth({
clientUrl:'http://exampole.com'
})
export default auth;
1.userRegistration({email,password,...}) 2.loginWithEmailPassword(email,password) 3.userInfo() 4.loginWithGoogle(response) 5.loginWithFacebook(response) 6.logout() 7.userPermissionUpdate([..permissions])
1.clientUrl
2.token
3.user
This function for user create or registration .
const registerUser = async()=>{
try {
let res = await auth.userRegistration({email,password}) //and you can add more fields by this object pattern just one remark those fields are also have to user model
console.log(res);
} catch (err) {
console.log(err.response.data);
}
}
Note: you can add more fields by this object pattern just one remark those fields are also have to user model
let res = await auth.userRegistration({email,password,firstName, lastName ,....ip,.. })
const customLogin = async()=>{
try {
let res = await auth.loginWithEmailPassword(email,password)
console.log(res);
} catch (err) {
console.log(err.response.data);
}
}
const getUserData = async()=>{
try {
let res = await auth.userInfo();
console.log('user',res);
console.log('all',auth);
} catch (err) {
console.log(err.response.data);
}
}
const responseGoogle = async(response)=>{
try {
let res = await auth.loginWithGoogle(response)
console.log(res);
} catch (error) {
console.log(error.response.data);
}
}
const responseFacebook = async(response)=>{
try {
let res = await auth.loginWithFacebook(response)
console.log(res);
} catch (error) {
console.log(error.response.data);
}
const logout =async ()=>{
auth.logout();
}
note: If you add 'update-user-permissions' this to permissions user can permitted to access control like admin
const userPermissionUpdate = async()=>{
try {
const res = await auth.userPermissionUpdate(['update-user-permissions','add-product','edit-product'])
console.log(res);
} catch (error) {
console.log(error.response.data);
}
}
FAQs
world easiest authentication
We found that auth-now demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.