Security News
ESLint is Now Language-Agnostic: Linting JSON, Markdown, and Beyond
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
Passport is an authentication middleware for Node.js that can be used in any Express-based web application. It supports a comprehensive set of strategies to authenticate users using a username and password, Facebook, Twitter, and more.
Local Authentication
This feature allows you to set up local authentication where users can log in with a username and password. The LocalStrategy is used to authenticate users against a local database.
passport.use(new LocalStrategy(
function(username, password, done) {
User.findOne({ username: username }, function (err, user) {
if (err) { return done(err); }
if (!user) { return done(null, false); }
if (!user.verifyPassword(password)) { return done(null, false); }
return done(null, user);
});
}
));
OAuth Authentication
Passport can be used to authenticate users using OAuth providers like GitHub, Facebook, Twitter, etc. This code sample demonstrates how to authenticate users with GitHub using the GitHubStrategy.
passport.use(new GitHubStrategy({
clientID: GITHUB_CLIENT_ID,
clientSecret: GITHUB_CLIENT_SECRET,
callbackURL: 'http://yourdomain.com/auth/github/callback'
},
function(accessToken, refreshToken, profile, cb) {
User.findOrCreate({ githubId: profile.id }, function (err, user) {
return cb(err, user);
});
}
));
JWT Authentication
Passport supports JSON Web Tokens (JWT) for securing API endpoints. The JwtStrategy is used to authenticate users based on a JWT token sent in the authorization header.
const JwtStrategy = require('passport-jwt').Strategy,
ExtractJwt = require('passport-jwt').ExtractJwt;
let opts = {}
opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();
opts.secretOrKey = 'secret';
passport.use(new JwtStrategy(opts, function(jwt_payload, done) {
User.findOne({id: jwt_payload.sub}, function(err, user) {
if (err) {
return done(err, false);
}
if (user) {
return done(null, user);
} else {
return done(null, false);
// or you could create a new account
}
});
}));
This package is a middleware that validates JSON Web Tokens for authentication purposes, similar to Passport's JWT strategy. It is specifically focused on JWT and does not support other authentication methods.
The oauth package provides a generic implementation of OAuth 1.0 and 2.0 that can be used for connecting to different OAuth providers. Unlike Passport, it does not come with pre-built strategies and requires more setup.
Grant is an OAuth middleware for Express, Koa, and Hapi, supporting over 180 providers out of the box. It is similar to Passport's OAuth strategies but is more focused on OAuth and social login flows.
Passport is an authentication framework for Connect and Express, which is extensible through "plugins" known as strategies.
Passport is designed to be a general-purpose, yet simple, modular, and unobtrusive, authentication framework. Passport's sole purpose is to authenticate requests. In being modular, it doesn't force any particular authentication strategy on your application. In being unobtrusive, it doesn't mount routes in your application. The API is simple: you give Passport a request to authenticate, and Passport provides hooks for controlling what occurs when authentication succeeds or fails.
$ npm install passport
Passport uses the concept of strategies to authenticate requests. Strategies can range from verifying username and password credentials, delegated authentication using OAuth (for example, via Facebook or Twitter), or federated authentication using OpenID.
Before asking passport to authenticate a request, the strategy (or strategies) used by an application must be configured.
passport.use(new LocalStrategy(
function(username, password, done) {
User.findOne({ username: username, password: password }, function (err, user) {
done(err, user);
});
}
));
Passport will maintain persistent login sessions. In order for persistent sessions to work, the authenticated user must be serialized to the session, and deserialized when subsequent requests are made.
Passport does not impose any restrictions on how your user records are stored. Instead, you provide a function to Passport which implements the necessary serialization and deserialization logic. In typical applications, this will be as simple as serializing the user ID, and finding the user by ID when deserializing.
passport.serializeUser(function(user, done) {
done(null, user.id);
});
passport.deserializeUser(function(id, done) {
User.findById(id, function (err, user) {
done(err, user);
});
});
To use Passport in a Connect or
Express-based application, configure it with the
required passport.initialize()
middleware. If your applications uses
persistent login sessions (recommended, but not required), passport.session()
middleware must also be used.
app.configure(function() {
app.use(express.cookieParser());
app.use(express.bodyParser());
app.use(express.session({ secret: 'keyboard cat' }));
app.use(passport.initialize());
app.use(passport.session());
app.use(app.router);
app.use(express.static(__dirname + '/../../public'));
});
Passport provides an authenticate()
function (which is standard
Connect/Express middleware), which is utilized to authenticate requests.
For example, it can be used as route middleware in an Express application:
app.post('/login',
passport.authenticate('local', { failureRedirect: '/login' }),
function(req, res) {
res.redirect('/');
});
For a complete, working example, refer to the login example included in Passport-Local.
Attention Developers: If you implement a new authentication strategy for Passport, send me a message and I will update the list.
$ npm install --dev
$ make test
Copyright (c) 2011-2013 Jared Hanson <http://jaredhanson.net/>
FAQs
Simple, unobtrusive authentication for Node.js.
The npm package passport receives a total of 2,330,567 weekly downloads. As such, passport popularity was classified as popular.
We found that passport demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
Security News
Members Hub is conducting large-scale campaigns to artificially boost Discord server metrics, undermining community trust and platform integrity.
Security News
NIST has failed to meet its self-imposed deadline of clearing the NVD's backlog by the end of the fiscal year. Meanwhile, CVE's awaiting analysis have increased by 33% since June.