This module is deprecated. Use feathers-authentication.
Add Authentication to your FeathersJS app.
feathers-authentication
adds shared PassportJS authentication for Feathers HTTP REST and WebSockets transports using JSON Web Tokens.
npm install feathers-authentication --save
This module contains:
- The main entry function
- An
authenticate
hook - The authentication
service
- Socket listeners
- Express middleware
- A Passport adapter
There is just 1 hook now called authenticate
. This can be used to authenticate a service method with a given strategy.
app.service('authentication').hooks({
before: {
create: [
// You can chain multiple strategies
auth.hooks.authenticate(['jwt', 'local']),
],
remove: [
auth.hooks.authenticate('jwt')
]
}
});
Just like hooks there is an authenticate
middleware. It is used the exact same way you would the regular passport express middleware.
app.post('/login', auth.express.authenticate('local', { successRedirect: '/app', failureRedirect: '/login' }));
The other middleware are included but typically you don't need to worry about them.
emitEvents
- emitlogin
andlogout
eventsexposeCookies
- expose cookies to Feathers so they are available to hooks and servicesexposeHeaders
- expose headers to Feathers so they are available to hooks and servicesfailureRedirect
- support redirecting on auth failure. Only triggered ifhook.redirect
is set.successRedirect
- support redirecting on auth success. Only triggered ifhook.redirect
is set.setCookie
- support setting the JWT access token in a cookie. Only enabled if cookies are enabled.
The following default options will be mixed in with your global auth
object from your config file. It will set the mixed options back to to the app so that they are available at any time by app.get('auth')
. They can all be overridden and are depended upon by some of the authentication plugins.
{
path: '/authentication', // the authentication service path
header: 'Authorization', // the header to use when using JWT auth
entity: 'user', // the entity that will be added to the request, socket, and hook.params. (ie. req.user, socket.user, hook.params.user)
service: 'users', // the service to look up the entity
passReqToCallback: true, // whether the request object should be passed to the strategies `verify` function
session: false, // whether to use sessions
cookie: {
enabled: false, // whether the cookie should be enabled
name: 'feathers-jwt', // the cookie name
httpOnly: false, // whether the cookie should not be available to client side JavaScript
secure: true // whether cookies should only be available over HTTPS
},
jwt: {
header: { typ: 'access' }, // by default is an access token but can be any type
audience: 'https://yourdomain.com', // The resource server where the token is processed
subject: 'anonymous', // Typically the entity id associated with the JWT
issuer: 'feathers', // The issuing server, application or resource
algorithm: 'HS256', // the algorithm to use
expiresIn: '1d' // the access token expiry
}
}
The following plugins are complementary but entirely optional:
- feathers-authentication-client
- feathers-authentication-local
- feathers-authentication-jwt
- feathers-authentication-oauth1
- feathers-authentication-oauth2
- feathers-permissions
Refer to the migration guide.
Here's an example of a Feathers server that uses feathers-authentication
for local auth.
Note: This does NOT implement any authorization. Use feathers-permissions for that.
const feathers = require('feathers');
const rest = require('feathers-rest');
const socketio = require('feathers-socketio');
const hooks = require('feathers-hooks');
const memory = require('feathers-memory');
const bodyParser = require('body-parser');
const errors = require('feathers-errors');
const errorHandler = require('feathers-errors/handler');
const local = require('feathers-authentication-local');
const jwt = require('feathers-authentication-jwt');
const auth = require('feathers-authentication');
const app = feathers();
app.configure(rest())
.configure(socketio())
.configure(hooks())
.use(bodyParser.json())
.use(bodyParser.urlencoded({ extended: true }))
.configure(auth({ secret: 'supersecret' }))
.configure(local())
.configure(jwt())
.use('/users', memory())
.use('/', feathers.static(__dirname + '/public'))
.use(errorHandler());
app.service('authentication').hooks({
before: {
create: [
// You can chain multiple strategies
auth.hooks.authenticate(['jwt', 'local'])
],
remove: [
auth.hooks.authenticate('jwt')
]
}
});
// Add a hook to the user service that automatically replaces
// the password with a hash of the password before saving it.
app.service('users').hooks({
before: {
find: [
auth.hooks.authenticate('jwt')
],
create: [
local.hooks.hashPassword({ passwordField: 'password' })
]
}
});
let server = app.listen(3030);
server.on('listening', function() {
console.log(`Feathers application started on localhost:${port}`);
});
You can use the client in the Browser, in NodeJS and in React Native.
import io from 'socket.io-client';
import feathers from 'feathers/client';
import hooks from 'feathers-hooks';
import socketio from 'feathers-socketio/client';
import localstorage from 'feathers-localstorage';
import authentication from 'feathers-authentication-client';
const socket = io('http://localhost:3030/');
const app = feathers()
.configure(socketio(socket)) // you could use Primus or REST instead
.configure(hooks())
.configure(authentication({ storage: window.localStorage }));
app.authenticate({
strategy: 'local',
email: 'admin@feathersjs.com',
password: 'admin'
}).then(function(result){
console.log('Authenticated!', result);
}).catch(function(error){
console.error('Error authenticating!', error);
});
Copyright (c) 2016
Licensed under the MIT license.