Skip to content
A hapi plugin to require multiple authentication strategies
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.

hapi-auth-multiple-strategies logo

Require multiple authentication strategies in hapi.

Installation · Usage · Strategy Options

Build Status Known Vulnerabilities hapi-auth-multiple-strategies Version Greenkeeper badge

Follow @marcuspoehls for updates!

The Future Studio University supports development of this hapi plugin 🚀
Join the Future Studio University and Skyrocket in Node.js


Add hapi-auth-multiple-strategies in your hapi project to authenticate a request against multiple authentication strategies. Hapi allows you to define multiple auth strategies on a route, but this requires only a single strategy to authenticate the request. In contrast, hapi-auth-multiple-strategies requires all strategies to be successful.


Add hapi-auth-multiple-strategies as a dependency to your project:

# NPM v5 users, this way is yours
npm i hapi-auth-multiple-strategies

# you’re using NPM v4:
npm i -S hapi-auth-multiple-strategies


Register hapi-auth-multiple-strategies to your hapi server. This will add the multiple-strategies authentication scheme to your hapi server.

await server.register({
  plugin: require('hapi-auth-multiple-strategies')

// went smooth like chocolate :)
// now your hapi server supports the 'multiple-strategies' auth scheme

Then declare a new authentication strategy base on the multiple-strategies scheme and pass in all required strategies.

// Assuming you have the following strategies your server
server.auth.strategy('jwt', 'bearer', options);
server.auth.strategy('jwt-refresh', 'token', options);

// create a new strategy that requires both 'jwt' strategies
server.auth.strategy('jwt-all-in', 'multiple-strategies', {
  strategies: ['jwt', 'jwt-refresh']

// use the 'jwt-all-in' strategy on your route
  method: 'GET',
  path: '/api/logout',
  config: {
    auth: 'jwt-all-in',
    handler: () => 'hey bud, you’re logged out'

The jwt-all-in strategy ensures that an incoming request satisfies both strategies, jwt and jwt-refresh.

If a request doesn’t authenticate with one or more of the strategies, it will return unauthenticated.

Authentication Strategy Options

When creating a new authentication strategy using the multiple-strategies scheme, you’re required to pass in an array of the authentication strategy names that are required.

  • strategies: (Array), required
    • an array of auth strategy names against a request will be authenticated

Credentials & Scope

Typically the request.auth.credentials is populated with the credentials from a single strategy. When testing multiple strategies, you’ll get the credentials from all strategies.

When a request passes all authentication strategies, the related credentials are assigned to the strategy’s name in request.auth.credentials.

Because hapi authorizes requests via the scope property, you’ll find the aggregated scope from all strategies in the credentials as well.

Here’s a sample result of request.auth.credentials:

  jwt: { name: 'Marcus', scope: [ 'admin' ] }
  'jwt-refresh': { username: 'marcus', name: 'Marcus', scope: [ 'user' ] }
  scope: [ 'admin', 'user' ]


Links & Resources


  1. Create a fork
  2. Create your feature branch: git checkout -b my-feature
  3. Commit your changes: git commit -am 'Add some feature'
  4. Push to the branch: git push origin my-new-feature
  5. Submit a pull request 🚀


MIT © Future Studio  ·  GitHub @futurestudio  ·  Twitter @futurestud_io

You can’t perform that action at this time.