Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Q: How do I set jwt auth to all routes? #149

Closed
abeninskibede opened this issue Mar 5, 2016 · 4 comments
Closed

Q: How do I set jwt auth to all routes? #149

abeninskibede opened this issue Mar 5, 2016 · 4 comments

Comments

@abeninskibede
Copy link

Hey guys,
I like your plugin but was wondering if there is a way to apply jwt-auth2 as default auth for all routes?
I see that you can specify config: {auth: 'jwt'} to a specific route but how do I enable this by default for all my routes?

@abeninskibede
Copy link
Author

Ah I just saw it's enabled by default for all routes. Maybe you can state this in your docs.

@nelsonic
Copy link
Member

nelsonic commented Mar 5, 2016

@abeninskibede thanks for getting in touch! My sincere apologies that the docs are unclear leading to any confusion. :-(
If you have time, would you mind creating a Pull Request to help improve them?

@abeninskibede
Copy link
Author

Will do thanks.

@nelsonic
Copy link
Member

How do I set JWT Auth to All Routes?

@abeninskibede asked how to set all routes to use JWT Auth in hapi-auth-jwt2/issues/149

We tend to enable hapi-auth-jwt2 for all routes by setting the mode parameter to true (so its required for all endpoints) because most of the endpoints in our app require the person/user to be authenticated e.g:

// setting the 3rd argument to true means 'mode' is 'required' see: http://hapijs.com/tutorials/auth#mode
server.auth.strategy('jwt', 'jwt', true, { // so JWT auth is required for all routes
  key: process.env.JWT_SECRET,
  validateFunc: require('./jwt2_validate_func'),
  verifyOptions: { ignoreExpiration: true, algorithms: [ 'HS256' ] }
});

Detailed Practical Example: https://github.com/dwyl/hapi-login-example-postgres/blob/245a44f0e88226d99a3ad2e3dc38cc0d1750a241/lib/server.js#L33

When you want a particular route to _not require_ JWT auth you simply set config: { auth: false } e.g:

  server.route({
    method: 'GET',
    path: '/login',
    handler: login_handler,  // display login/registration form/page
    config: { auth: false } // don't require people to be logged in to see the login page! (duh!)
  });

The best place to understand everything about Hapi Auth is in the docs: http://hapijs.com/tutorials/auth#setting-a-default-strategy
But if you have any questions which are not answered there, feel free to ask!

See README 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants