http-auth
Advanced tools
The http-auth npm package provides basic and digest access authentication for Node.js applications. It allows developers to secure their web applications by requiring users to provide a username and password before accessing certain routes or resources.
Basic Authentication
This feature allows you to set up basic authentication for your Node.js server. Users will need to provide a username and password to access the protected routes.
const http = require('http');
const auth = require('http-auth');
const basic = auth.basic({
realm: 'Simon Area',
file: __dirname + '/users.htpasswd' // user:password in htpasswd format
});
http.createServer(basic, (req, res) => {
res.end(`Welcome to private area - ${req.user}!`);
}).listen(1337, () => {
console.log('Server running at http://127.0.0.1:1337/');
});Digest Authentication
This feature allows you to set up digest authentication for your Node.js server. Digest authentication is more secure than basic authentication as it uses MD5 hashing.
const http = require('http');
const auth = require('http-auth');
const digest = auth.digest({
realm: 'Simon Area',
file: __dirname + '/users.htdigest' // user:realm:password in htdigest format
});
http.createServer(digest, (req, res) => {
res.end(`Welcome to private area - ${req.user}!`);
}).listen(1337, () => {
console.log('Server running at http://127.0.0.1:1337/');
});The express-basic-auth package provides basic authentication middleware for Express applications. It is simpler to use with Express compared to http-auth and integrates seamlessly with the Express framework.
The passport-http package is a Passport strategy for HTTP Basic and Digest authentication. It is part of the Passport.js ecosystem, which provides a wide range of authentication strategies and is highly extensible.
The basic-auth package is a simple tool for parsing basic authentication headers. It does not provide full authentication middleware but can be used in conjunction with other packages to implement basic authentication.
Node.js package for HTTP basic and digest access authentication.
Via git (or downloaded tarball):
$ git clone git://github.com/http-auth/http-auth.git
Via npm:
$ npm install http-auth
// HTTP module
const http = require("http");
// Authentication module.
const auth = require("http-auth");
const basic = auth.basic({
realm: "Simon Area.",
file: __dirname + "/../data/users.htpasswd" // gevorg:gpass, Sarah:testpass
});
// Creating new HTTP server.
http
.createServer(
basic.check((req, res) => {
res.end(`Welcome to private area - ${req.user}!`);
})
)
.listen(1337, () => {
// Log URL.
console.log("Server running at http://127.0.0.1:1337/");
});
// HTTP module
const http = require("http");
// Authentication module.
const auth = require("http-auth");
const basic = auth.basic(
{
realm: "Simon Area."
},
(username, password, callback) => {
// Custom authentication method.
callback(username === "Tina" && password === "Bullock");
}
);
// Creating new HTTP server.
http
.createServer(
basic.check((req, res) => {
res.end(`Welcome to private area - ${req.user}!`);
})
)
.listen(1337, () => {
// Log URL.
console.log("Server running at http://127.0.0.1:1337/");
});
// HTTP proxy module.
const http = require("http");
// eslint-disable-next-line node/no-unpublished-require
const httpProxy = require("http-proxy");
// Authentication module.
const auth = require("http-auth");
const basic = auth.basic({
realm: "Simon Area.",
file: __dirname + "/../data/users.htpasswd", // gevorg:gpass, Sarah:testpass
proxy: true
});
// Create your proxy server.
const proxy = httpProxy.createProxyServer({});
http
.createServer(
basic.check((req, res) => {
proxy.web(req, res, { target: "http://127.0.0.1:1338" });
})
)
.listen(1337);
// Create your target server.
http
.createServer((req, res) => {
res.end("Request successfully proxied!");
})
.listen(1338, () => {
// Log URL.
console.log("Server running at http://127.0.0.1:1338/");
});
// You can test proxy authentication using curl.
// $ curl -x 127.0.0.1:1337 127.0.0.1:1337 -U gevorg
The auth middleware emits three types of events: error, fail and success. Each event passes the result object (the error in case of fail) and the http request req to the listener function.
// HTTP module
const http = require("http");
// Authentication module.
const auth = require("http-auth");
const basic = auth.basic({
realm: "Simon Area.",
file: __dirname + "/../data/users.htpasswd" // gevorg:gpass, Sarah:testpass
});
// Adding event listeners.
basic.on("success", result => {
console.log(`User authenticated: ${result.user}`);
});
basic.on("fail", result => {
console.log(`User authentication failed: ${result.user}`);
});
basic.on("error", error => {
console.log(`Authentication error: ${error.code + " - " + error.message}`);
});
// Creating new HTTP server.
http
.createServer(
basic.check((req, res) => {
res.end(`Welcome to private area - ${req.user}!`);
})
)
.listen(1337, () => {
// Log URL.
console.log("Server running at http://127.0.0.1:1337/");
});
realm - Authentication realm, by default it is Users.file - File where user details are stored.
algorithm - Algorithm that will be used only for digest access authentication.
qop - Quality of protection that is used only for digest access authentication.
msg401 - Message for failed authentication 401 page.msg407 - Message for failed authentication 407 page.contentType - Content type for failed authentication page.skipUser - Set this to true, if you don't want req.user to be filled with authentication info.proxy - Set this to true, if you want to use it with http-proxy.It uses mocha, so just run following command in package directory:
$ npm test
You can find list of issues using this link.
You can also use stackoverflow to ask questions using http-auth tag.
The MIT License (MIT)
Copyright (c) Gevorg Harutyunyan
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
Node.js package for HTTP basic and digest access authentication.
The npm package http-auth receives a total of 177,440 weekly downloads. As such, http-auth popularity was classified as popular.
We found that http-auth demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.
Security News
PyPI now supports digital attestations, enhancing security and trust by allowing package maintainers to verify the authenticity of Python packages.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.