passport-http-bearer

What is passport-http-bearer?

The passport-http-bearer npm package is a Passport strategy for authenticating with a bearer token. This module lets you authenticate HTTP requests using bearer tokens, typically used to protect API endpoints. Bearer tokens are usually generated by an authorization server and are used to access protected resources.

What are passport-http-bearer's main functionalities?

Authenticate Requests Using Bearer Tokens

This feature allows you to authenticate HTTP requests using bearer tokens. The code sample demonstrates how to set up the BearerStrategy with Passport and protect an endpoint using this strategy.

const passport = require('passport');
const BearerStrategy = require('passport-http-bearer').Strategy;

passport.use(new BearerStrategy(
  function(token, done) {
    User.findByToken(token, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      return done(null, user);
    });
  }
));

// Protect an endpoint
app.get('/profile', 
  passport.authenticate('bearer', { session: false }),
  function(req, res) {
    res.json(req.user);
  });

Other packages similar to passport-http-bearer

passport-jwt

The passport-jwt package is another Passport strategy for authenticating with JSON Web Tokens (JWT). It is similar to passport-http-bearer in that it is used to protect API endpoints, but it specifically deals with JWTs instead of generic bearer tokens.

express-bearer-token

The express-bearer-token package is a middleware for Express that extracts bearer tokens from HTTP requests. While it does not provide authentication out of the box like passport-http-bearer, it can be used in conjunction with other authentication mechanisms to achieve similar functionality.

oauth2orize

The oauth2orize package is a toolkit for implementing OAuth 2.0 authorization servers. It can be used to issue bearer tokens, which can then be authenticated using passport-http-bearer. It provides a more comprehensive solution for OAuth 2.0 compared to passport-http-bearer, which focuses solely on authentication.

README

passport-http-bearer

HTTP Bearer authentication strategy for Passport.

This module lets you authenticate HTTP requests using bearer tokens, as specified by RFC 6750, in your Node.js applications. Bearer tokens are typically used protect API endpoints, and are often issued using OAuth 2.0.

By plugging into Passport, bearer token support can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.

Install

$ npm install passport-http-bearer

Usage

Configure Strategy

The HTTP Bearer authentication strategy authenticates users using a bearer token. The strategy requires a verify callback, which accepts that credential and calls done providing a user. Optional info can be passed, typically including associated scope, which will be set by Passport at req.authInfo to be used by later middleware for authorization and access control.

passport.use(new BearerStrategy(
  function(token, done) {
    User.findOne({ token: token }, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      return done(null, user, { scope: 'all' });
    });
  }
));

Authenticate Requests

Use passport.authenticate(), specifying the 'bearer' strategy, to authenticate requests. Requests containing bearer tokens do not require session support, so the session option can be set to false.

For example, as route middleware in an Express application:

app.get('/profile', 
  passport.authenticate('bearer', { session: false }),
  function(req, res) {
    res.json(req.user);
  });

Issuing Tokens

Bearer tokens are typically issued using OAuth 2.0. OAuth2orize is a toolkit for implementing OAuth 2.0 servers and issuing bearer tokens. Once issued, this module can be used to authenticate tokens as described above.

Examples

For a complete, working example, refer to the Bearer example.

Related Modules

• OAuth2orize — OAuth 2.0 authorization server toolkit

Tests

$ npm install
$ npm test

Credits

• Jared Hanson

License

The MIT License

Copyright (c) 2011-2013 Jared Hanson <http://jaredhanson.net/>