cf-auth-middleware

cf-auth-middleware

Authentication middleware for APIs using cf-auth-provider

Installation

npm install --save cf-auth-middleware

Usage

var express = require('express')
  , createAuthMiddleware = require('cf-auth-middleware')
  , authProvider = require('cf-auth-provider')(myCollection, hashFn)

var app = express()
  , authMiddleware = createAuthMiddleware(authProvider)

app.get('/private', authMiddleware, function (req, res) {
  // This route is only accessible to users that are
  // able to authenticate with the given authProvider
})

An authenticated request contains the following headers:

Content-Type: 'application/json'
x-cf-date: 'Tue, 05 Nov 2013 12:22:23 GMT'
authorization: 'Catfish {authorizing entity id}:{signed request}'

The client must sign the request with the following algorithm:

var crypto = require('crypto')

function createSignature(key, method, contentType, date, path) {
  var hmac = crypto.createHmac('sha1', key)
    , packet = method + '\n\n' + (contentType || '') + '\n' + date + '\n\n' + path
  return hmac.update(packet).digest('base64')
}

API

var createMiddleware = require('cf-auth-middleware')

var middleware = createMiddleware(AuthProvider: authProvider, Object: options)

authProvider is an instance of cf-auth-provider.

Options:

• options.logger: an object with debug(), info(), warn(), error(). Defaults to console.
• options.reqProperty: the authed client's id is stored on the request object: req[options.reqProperty]. Defaults to authedClient.

Credits

Built by developers at Clock.

Licence

Licensed under the New BSD License