AuthBus authentication strategy for Passport.
This module lets you authenticate HTTP requests using bearer tokens, as specified by RFC 6750, in your Node.js applications. Bearer tokens are typically used to protect API endpoints, and are often issued using OAuth 2.0.
By plugging into Passport, bearer token support can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.
Start a 10-day free trial at Pluralsight - Over 5,000 Courses Available
$ npm install passport-authbus
The AuthBus authentication strategy authenticates users using a bearer
token. The strategy requires a verify callback, which accepts that
user profile and calls done providing a user. Optional info can be passed,
typically including associated scope, which will be set by Passport at
req.authInfo to be used by later middleware for authorization and access
control.
passport.use(new AuthBusStrategy({
authbusEndpoint: 'http://server-name.authbus.com'
},
function(profile, done) {
User.findOne({ authbusUserId: profile.id }, function (err, user) {
if (err) { return done(err); }
if (!user) { return done(null, false); }
return done(null, user, { scope: 'all' });
});
}
));Use passport.authenticate(), specifying the 'authbus' strategy, to
authenticate requests. Requests containing bearer tokens do not require session
support, so the session option can be set to false.
For example, as route middleware in an Express application:
app.get('/profile',
passport.authenticate('authbus', { session: false }),
function(req, res) {
res.json(req.user);
});Bearer tokens are typically issued using OAuth 2.0. OAuth2orize is a toolkit for implementing OAuth 2.0 servers and issuing bearer tokens. Once issued, this module can be used to authenticate tokens as described above.
The HTTP Bearer authentication strategy authenticates requests based on a bearer token contained in the:
Authorizationheader field where the value is in the format{scheme} {token}and scheme is "Bearer" in this case.- or
access_tokenbody parameter - or
access_tokenquery parameter
For a complete, working example, refer to the Bearer example.
- OAuth2orize — OAuth 2.0 authorization server toolkit
Copyright (c) 2011-2013 Jared Hanson <http://jaredhanson.net/>