passport-jwt

What is passport-jwt?

The passport-jwt npm package is a Passport strategy for authenticating with JSON Web Tokens (JWT). It allows you to secure your endpoints and authenticate requests using JWTs, which are often used in stateless authentication mechanisms.

What are passport-jwt's main functionalities?

JWT Authentication Strategy

This feature allows you to set up a JWT authentication strategy using Passport. The code sample demonstrates how to configure the strategy with options such as extracting the JWT from the authorization header and specifying the secret key. The strategy then verifies the token and retrieves the user information.

const passport = require('passport');
const { Strategy: JwtStrategy, ExtractJwt } = require('passport-jwt');

const opts = {
  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
  secretOrKey: 'your_jwt_secret'
};

passport.use(new JwtStrategy(opts, (jwt_payload, done) => {
  User.findById(jwt_payload.sub, (err, user) => {
    if (err) {
      return done(err, false);
    }
    if (user) {
      return done(null, user);
    } else {
      return done(null, false);
    }
  });
}));

Protecting Routes

This feature allows you to protect specific routes in your application. The code sample shows how to use the `passport.authenticate` middleware to secure the `/protected` route, ensuring that only authenticated users with a valid JWT can access it.

const express = require('express');
const passport = require('passport');

const app = express();

app.get('/protected', passport.authenticate('jwt', { session: false }), (req, res) => {
  res.json({ message: 'You have accessed a protected route!', user: req.user });
});

Other packages similar to passport-jwt

jsonwebtoken

The jsonwebtoken package is a popular library for creating and verifying JSON Web Tokens. Unlike passport-jwt, it does not provide a Passport strategy but focuses on the core functionality of JWT handling. It can be used in conjunction with other authentication strategies or frameworks.

express-jwt

The express-jwt package is a middleware for Express that validates JWTs and sets `req.user` if the token is valid. It is similar to passport-jwt but is more lightweight and does not require Passport. It is ideal for applications that do not need the full Passport ecosystem.

koa-jwt

The koa-jwt package is a middleware for Koa that validates JWTs and sets `ctx.state.user` if the token is valid. It is similar to express-jwt but designed specifically for Koa applications. It provides a straightforward way to secure Koa routes with JWT authentication.

README

passport-jwt

A Passport strategy for authenticating with a JSON Web Token.

This module lets you authenticate endpoints using a JSON Web token. It is intended to be used to secure RESTful endpoints without sessions.

Install

npm install passport-jwt

Usage

Configure Strategy

The jwt authentication strategy is constructed as follows:

new JwtStrategy(options, verify)

options is an object literal containing options to control how the token is extracted from the request or verified.

• secretOrKey is a REQUIRED string or buffer containing the secret (symmetric) or PEM-encoded public key (asymmetric) for verifying the token's signature.
• issuer: If defined the token issuer (iss) will be verified against this value.
• audience: If defined, the token audience (aud) will be verified against this value.
• tokenBodyField: Field in a request body to search for the jwt. Default is auth_token.
• tokenQueryParameterName: Query parameter name containing the token. Default is auth_token.
• authScheme: Expected authorization scheme if token is submitted through the HTTP Authorization header. Defaults to JWT
• passReqToCallback: If true the request will be passed to the verify callback. i.e. verify(request, jwt_payload, done_callback).

verify is a function with args verify(jwt_payload, done)

• jwt_payload is an object literal containing the decoded JWT payload.
• done is a passport error first callback accepting arguments done(error, user, info)

An example configuration:

var JwtStrategy = require('passport-jwt').Strategy;
var opts = {}
opts.secretOrKey = 'secret';
opts.issuer = "accounts.examplesoft.com";
opts.audience = "yoursite.net";
passport.use(new JwtStrategy(opts, function(jwt_payload, done) {
    User.findOne({id: jwt_payload.sub}, function(err, user) {
        if (err) {
            return done(err, false);
        }
        if (user) {
            done(null, user);
        } else {
            done(null, false);
            // or you could create a new account
        }
    });
}));

Authenticate requests

Use passport.authenticate() specifying 'jwt' as the strategy.

app.post('/profile', passport.authenticate('jwt', { session: false}),
    function(req, res) {
        res.send(req.user.profile);
    }
);

Include the JWT in requests

The strategy will first check the request for the standard Authorization header. If this header is present and the scheme matches options.authScheme or 'JWT' if no auth scheme was specified then the token will be retrieved from it. e.g.

Authorization: JWT JSON_WEB_TOKEN_STRING.....

If the authorization header with the expected scheme is not found, the request body will be checked for a field matching either options.tokenBodyField or auth_token if the option was not specified.

Finally, the URL query parameters will be checked for a field matching either options.tokenQueryParameterName or auth_token if the option was not sepcified.

Tests

npm install
npm test

License

The MIT License

Copyright (c) 2015 Mike Nicholson