Repository files navigation

HTTP Bearer authentication strategy forPassport.

This module lets you authenticate HTTP requests usingbearer tokens,as specified byRFC 6750, in yourNode.js applications. By plugging into Passport, bearer token support can beeasily and unobtrusively integrated into any application or framework thatsupportsConnect-stylemiddleware, includingExpress.

^{Advertisement}
Node.js, Express, MongoDB & More: The Complete Bootcamp 2020
Master Node by building a real-world RESTful API and web app (with authentication, Node.js security, payments & more)

...

$ npm install passport-http-bearer

$ npm install @types/passport-http-bearer

The HTTP Bearer authentication strategy authenticates users using a bearertoken. The strategy requires averify callback, which accepts thatcredential and callsdone providing a user. Optionalinfo can be passed,typically including associated scope, which will be set by Passport atreq.authInfo to be used by later middleware for authorization and accesscontrol.

passport.use(newBearerStrategy(function(token,done){User.findOne({token:token},function(err,user){if(err){returndone(err);}if(!user){returndone(null,false);}returndone(null,user,{scope:'all'});});}));

Usepassport.authenticate(), specifying the'bearer' strategy, toauthenticate requests. Requests containing bearer tokens do not require sessionsupport, so thesession option can be set tofalse.

For example, as route middleware in anExpressapplication:

app.get('/profile',passport.authenticate('bearer',{session:false}),function(req,res){res.json(req.user);});

Bearer tokens are typically issued using OAuth 2.0.OAuth2orizeis a toolkit for implementing OAuth 2.0 servers and issuing bearer tokens. Onceissued, this module can be used to authenticate tokens as described above.

The HTTP Bearer authentication strategy authenticates requests based on a bearer token contained in the:

• Authorization header field where the value is in the format{scheme} {token} and scheme is "Bearer" in this case.
• oraccess_token body parameter
• oraccess_token query parameter

For a complete, working example, refer to theBearer example.

• OAuth2orize — OAuth 2.0 authorization server toolkit

The MIT License

Copyright (c) 2011-2013 Jared Hanson <https://www.jaredhanson.me/>