Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
HTTP Bearer authentication strategy for Passport and Node.js.
JavaScript
Tag: v0.2.1

Fetching latest commit…

Cannot retrieve the latest commit at this time

Failed to load latest commit information.
examples/bearer
lib/passport-http-bearer
test
.gitignore
.npmignore
.travis.yml
LICENSE
Makefile
README.md
package.json

README.md

Passport-HTTP-Bearer

HTTP Bearer authentication strategy for Passport.

This module lets you authenticate HTTP requests using bearer tokens in your Node.js applications. Bearer tokens are typically used protect API endpoints, and are often issued using OAuth 2.0.

By plugging into Passport, bearer token support can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.

Install

$ npm install passport-http-bearer

Usage

Configure Strategy

The HTTP Bearer authentication strategy authenticates users using a bearer token. The strategy requires a verify callback, which accepts that credential and calls done providing a user. Optional info can be passed, typically including associated scope, which will be set by Passport at req.authInfo to be used by later middleware for authorization and access control.

passport.use(new BearerStrategy(
  function(token, done) {
    User.findOne({ token: token }, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      return done(null, user, { scope: 'all' });
    });
  }
));

Authenticate Requests

Use passport.authenticate(), specifying the 'bearer' strategy, to authenticate requests. Requests containing bearer tokens do not require session support, so the session option can be set to false.

For example, as route middleware in an Express application:

app.get('/profile', 
  passport.authenticate('bearer', { session: false }),
  function(req, res) {
    res.json(req.user);
  });

Implementation

This module is implemented based on The OAuth 2.0 Authorization Protocol: Bearer Tokens, Draft 12. Implementers are encouraged to track the progress of this specification and update update their implementations as necessary. Furthermore, the implications of relying on a non-final draft specification should be understood prior to deployment.

Examples

For a complete, working example, refer to the Bearer example.

Tests

$ npm install --dev
$ make test

Build Status

Credits

License

The MIT License

Copyright (c) 2011-2013 Jared Hanson <http://jaredhanson.net/>

Something went wrong with that request. Please try again.