Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
jwt-session-manager
Advanced tools
Readme
Implement store and validation functions:
// Optional
const storeJWTSecretHandler = async (jwtSecret) => {
await db.put('sessionEncryptSecret', jwtSecret);
};
const validateRequestHandler = async ({username, password}) => {
const userAndPasswordValid = /* Boolean */;
return userAndPasswordValid;
};
const storeSessionKeyHandler = async (sessionKey, {username}) => {
const users = await db.get('users');
users[username].sessionKey = sessionKey;
return await db.put('users', users).then(() => sessionKey).catch(() => null);
};
const validateSessionKeyInStoreHandler = async (sessionKey, {username}) => {
const users = await db.get('users');
return (users[username] || {}).sessionKey === sessionKey;
};
Instantiate Server Session Manager:
const sessionManager = new ServerJWTSessionManager({
jwtSecret: await db.get('sessionSecret', {asBuffer: false}).catch((e) => null),
storeJWTSecretHandler,
validateRequestHandler,
storeSessionKeyHandler,
validateSessionKeyInStoreHandler,
});
// If you implement storeJWTSecretHandler you can wait for
// the JWT secret to be stored using jwtSecretStorePromise
await sessionManager.jwtSecretStorePromise.then(() => console.log(sessionManager.jwtSecret));
Use the Server Session Manager instance to validate:
app.get('/request-token', (request, response) => {
response.end(sessionManager.generateSessionRequestToken());
});
app.post('/login', (request, response) => {
const {
requestToken,
username,
password,
} = request.body;
const sessionToken = await sessionManager.processSessionRequest(requestToken, {
username,
password,
});
if (!sessionToken) {
return handleNotAuthorized(request, response);
}
response.end(sessionToken);
});
app.get('/logout', async (request, response) => {
const sessionToken = request.headers['authorization'].replace(/^Bearer\s/, '');
const username = request.headers['user'];
const valid = await sessionManager.checkSessionToken(sessionToken, {username});
if (!valid) {
return handleNotAuthorized(request, response);
}
const users = await db.get('users');
const {
sessionKey,
...loggetOutUserData
} = users[username];
users[username] = loggetOutUserData;
await db.put('users', users);
response.end('ok');
});
app.get('/user', async (request, response) => {
const sessionToken = request.headers['authorization'].replace(/^Bearer\s/, '');
const username = request.headers['user'];
const valid = await sessionManager.checkSessionToken(sessionToken, {username});
if (!valid) {
return handleNotAuthorized(request, response);
}
const users = await db.get('users', {asBuffer: false});
const {
sessionKey,
password,
...safeUserData
} = users[username];
response.end(JSON.stringify(safeUserData));
});
Implement get functions (required):
// This example is for browser with bluebird and jquery
// for other versions in "examples" directory
var getSessionRequestTokenHandler = function() {
return new Promise(function(resolve, reject) {
$.get('request-token', function(data) {
resolve(data);
});
})
};
var getSessionHandler = function(sessionRequestToken) {
return new Promise(function(resolve, reject) {
var loginOptions = {
requestToken: sessionRequestToken,
username: $('.username')[0].value,
password: $('.password')[0].value,
};
$.post('login', loginOptions, function(data) {
resolve(data);
}).fail(function() {
reject(null);
});
});
};
Optionally implement store and/or close functions:
var storeSessionRequestTokenHandler = function(sessionRequestToken) {
return new Promise(function(resolve, reject) {
try {
window.localStorage.setItem('requestToken', sessionRequestToken);
resolve();
} catch (e) {
reject(e);
}
});
};
var storeSessionTokenHandler = function(sessionToken) {
return new Promise(function(resolve, reject) {
try {
window.localStorage.setItem('sessionToken', sessionToken);
window.localStorage.setItem('username', $('.username')[0].value);
window.localStorage.removeItem('requestToken');
resolve();
} catch (e) {
reject(e);
}
});
};
var closeSessionHandler = function(sessionToken) {
return new Promise(function(resolve, reject) {
try {
window.localStorage.removeItem('sessionToken');
resolve();
} catch (e) {
reject(e);
}
});
};
Instantiate Client Session Manager:
var sessionManager = new ClientJWTSessionManager({
getSessionRequestTokenHandler,
storeSessionRequestTokenHandler,
getSessionHandler,
storeSessionTokenHandler,
closeSessionHandler,
}, {
// Optional to keep session alive, in this example only works if you implemented
// storeSessionRequestTokenHandler and storeSessionTokenHandler
sessionRequestToken: window.localStorage.getItem('requestToken'),
sessionToken: window.localStorage.getItem('sessionToken'),
});
Use the Client Session Manager instance to request data safely:
var initializeLoginForm = function() {
$('.login-button').click(function(e) {
e.preventDefault();
sessionManager.getSession().then(function() {
// You are logged in, you can redirect or do something here
}).catch(function() {
sessionManager.getSessionRequestToken().then(function() {
alert('You took too long to log in, reload the page and try again.');
}).catch(function() {
alert('Unable to get request token from server.');
})
});
});
};
sessionManager.getSessionRequestToken().then(initializeLoginForm);
Tests implemented using jest
yarn test
Linting uses tslint
yarn lint
Build uses rollup to build Node module and Browser compatible dist files
yarn build
note: if you change version be sure to run tests before build so version file gets updated
In the examples
directory
Better documentation
Contributions welcome and encouraged
Apache 2.0
FAQs
Server and client functions for handling sessions using JWT
The npm package jwt-session-manager receives a total of 118 weekly downloads. As such, jwt-session-manager popularity was classified as not popular.
We found that jwt-session-manager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.