passport-headerapikey

What is passport-headerapikey?

The passport-headerapikey npm package is a Passport strategy for authenticating with an API key passed in a header. It allows you to protect your routes by requiring a valid API key for access.

What are passport-headerapikey's main functionalities?

Basic API Key Authentication

This feature allows you to set up basic API key authentication using the passport-headerapikey strategy. The provided code demonstrates how to configure the strategy and protect a route in an Express application.

const passport = require('passport');
const HeaderAPIKeyStrategy = require('passport-headerapikey').HeaderAPIKeyStrategy;

passport.use(new HeaderAPIKeyStrategy(
  { header: 'Authorization', prefix: 'Api-Key ' },
  false,
  (apikey, done) => {
    if (apikey === 'your_api_key') {
      return done(null, true);
    } else {
      return done(null, false);
    }
  }
));

// Express setup
const express = require('express');
const app = express();

app.use(passport.initialize());

app.get('/protected', passport.authenticate('headerapikey', { session: false }), (req, res) => {
  res.send('This is a protected route');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

Other packages similar to passport-headerapikey

passport-http-bearer

The passport-http-bearer package is a Passport strategy for authenticating with a bearer token. It is similar to passport-headerapikey in that it allows you to protect routes using a token, but it uses the Bearer token scheme instead of a custom header.

passport-custom

The passport-custom package allows you to create custom authentication strategies. It provides more flexibility compared to passport-headerapikey, as you can define your own logic for extracting and validating credentials from the request.

README

Passport-HeaderAPIKey

Passport strategy for authenticating with a apikey.

This module lets you authenticate using a apikey in your Node.js applications which is used to build rest apis. By plugging into Passport, apikey authentication can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.

Installation

$ npm install passport-headerapikey

Usage

Configure Strategy

The api key authentication strategy authenticates users using a apikey. The strategy requires a verify callback, which accepts these credentials and calls done providing a user.

    const HeaderAPIKeyStrategy = require('passport-headerapikey').HeaderAPIKeyStrategy
    
    passport.use(new HeaderAPIKeyStrategy(
      { header: 'Authorization', prefix: 'Api-Key ' },
      false,
      function(apikey, done) {
        User.findOne({ apikey: apikey }, function (err, user) {
          if (err) { return done(err); }
          if (!user) { return done(null, false); }
          return done(null, user);
        });
      }
    ));

Authenticate Requests

Use passport.authenticate(), specifying the 'headerapikey' strategy, to authenticate requests.

For example, as route middleware in an Express application:

app.post('/api/authenticate', 
  passport.authenticate('headerapikey', { session: false, failureRedirect: '/api/unauthorized' }),
  function(req, res) {
    res.json({ message: "Authenticated" })
  });

API

Constructor

new HeaderAPIKeyStrategy(header, passReqToCallback, verify);

Arguments:

• headerConfig (Object):
  • header (String): name of the header field to be used for api keys, default: X-Api-Key.
  • prefix (String): prefix to be used in content of the header, eg. Bearer adsfadsfa, default: empty. Attention: give it with blank if needed, eg. 'Bearer '.
• passReqToCallback (Boolean): flags whether an express Request object is passed to the verify function.
• verify (Function):
  • apiKey (String): parsed API key from from the request. Use it to determine, which user is using your endpoint.
  • verified (Function): Callback to be called when you have done the API key handling. Signature: verify(err, user, info) => void.
    • err (Error): return an Error if user is not verified, otherwise yield null here
    • user (Object, optional): only return user object if he is verified.
    • info(Object, optional): yield additional information to success or failure of user verification.
  • req (express.Request, optional): express Request object if passReqToCallback is set to true.

Examples

curl -v --header "Authorization: Api-Key asdasjsdgfjkjhg" http://127.0.0.1:3000/api/authenticate

Contributing

Clone the repo, then

npm install

and here we go. Develop your new features or fixes, test it using npm test and create a pull request.

Credits

• CholaLabs