Express/conect middleware for basic token authentication.
This is a very basic authentication middleware which simply looks for a present token in query, body or headers. This could be used for basic APIs which do not require a complex authentication or authorization process. But at the same time it adds some level of security to prevent from completely open public access to your API (e.g. useful for internal company APIs).
$ npm install express-basic-token --save
token
(String
) - Token secret key.tokenName
(String
) - Token name which will be searched for in query, params or headers. Default:x-access-token
notAuthorizedJSON
(Object
) - object returned to the client when token does not match. Default:{ message: 'Not Authorized' }
invalidTokenJSON
(Object
) - object returned to the client when token is not present or listed in multiple places. Default:{ message: 'Invalid Token' }
Basic usage
ES5
var basicAuthToken = require('express-basic-token');
app.use(basicAuthToken({ token: 'very-secret' });
ES6
import basicAuthToken from 'express-basic-token';
app.use(basicAuthToken({ token: 'very-secret' });
To apply middleware for specific routes
app.use('/protected/*', basicAuthToken({ token: 'very-secret' });
To make exception for protected routes
app.use('/protected/*', basicAuthToken({ token: 'very-secret' }).unless({ path: ['/protected/not/this/one'] }));
or another example
app.use(basicAuthToken({ token: 'very-secret' }).unless({ path: ['/not-protected/*'] }));
Unless allows you to specify array or regex or string or for any other extra options, please see express-unless.
You can specify your custom error objects for invalid token authorization
app.use(basicAuthToken({
token: 'very-secret',
invalidTokenJSON: { message: 'Server Error' },
notAuthorizedJSON: { message: 'Not Allowed!' }
});
To specify custom token header
app.use(basicAuthToken({
token: 'very-secret',
tokenName: 'MY-TOKEN'
});
MIT license; see LICENSE.