Skip to content
Basic authentication plugin
JavaScript
Branch: master
Clone or download
Latest commit b82ce64 Aug 15, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
lib Update deps. Closes #69 Apr 18, 2019
test Update deps. Closes #69 Apr 18, 2019
.gitignore Update deps. Closes #69 Apr 18, 2019
.npmignore Upgrade to hapi 17.x.x support Nov 11, 2017
.travis.yml Fix scope Aug 15, 2019
CHANGELOG.md Add changelog.md Dec 3, 2018
LICENSE.md Update deps. Closes #69 Apr 18, 2019
README.md Update README.md Aug 14, 2019
package.json 5.1.1 Aug 13, 2019

README.md

basic

Build Status

Basic authentication requires validating a username and password combination. The 'basic' scheme takes the following options:

  • validate - (required) a user lookup and password validation function with the signature [async] function(request, username, password, h) where:
    • request - is the hapi request object of the request which is being authenticated.
    • username - the username received from the client.
    • password - the password received from the client.
    • h - the response toolkit.
    • Returns an object { isValid, credentials, response } where:
      • isValid - true if both the username was found and the password matched, otherwise false.
      • credentials - a credentials object passed back to the application in request.auth.credentials.
      • response - Optional. If provided will be used immediately as a takeover response. Can be used to redirect the client, for example. Don't need to provide isValid or credentials if response is provided
    • Throwing an error from this function will replace default Boom.unauthorized error
    • Typically, credentials are only included when isValid is true, but there are cases when the application needs to know who tried to authenticate even when it fails (e.g. with authentication mode 'try').
  • allowEmptyUsername - (optional) if true, allows making requests with an empty username. Defaults to false.
  • unauthorizedAttributes - (optional) if set, passed directly to Boom.unauthorized if no custom err is thrown. Useful for setting realm attribute in WWW-Authenticate header. Defaults to undefined.
const Bcrypt = require('bcrypt');
const Hapi = require('@hapi/hapi');

const users = {
    john: {
        username: 'john',
        password: '$2a$10$iqJSHD.BGr0E2IxQwYgJmeP3NvhPrXAeLSaGCj6IR/XU5QtjVu5Tm',   // 'secret'
        name: 'John Doe',
        id: '2133d32a'
    }
};

const validate = async (request, username, password, h) => {

    if (username === 'help') {
        return { response: h.redirect('https://hapijs.com/help') };     // custom response
    }

    const user = users[username];
    if (!user) {
        return { credentials: null, isValid: false };
    }

    const isValid = await Bcrypt.compare(password, user.password);
    const credentials = { id: user.id, name: user.name };

    return { isValid, credentials };
};

const main = async () => {

    const server = Hapi.server({ port: 4000 });

    await server.register(require('@hapi/basic'));

    server.auth.strategy('simple', 'basic', { validate });
    server.auth.default('simple');

    server.route({
        method: 'GET',
        path: '/',
        handler: function (request, h) {

            return 'welcome';
        }
    });

    await server.start();

    return server;
};

main()
.then((server) => console.log(`Server listening on ${server.info.uri}`))
.catch((err) => {

    console.error(err);
    process.exit(1);
});
You can’t perform that action at this time.