jaredhanson / passport-browserid

BrowserID authentication strategy for Passport and Node.js.

passport-browserid

Passport strategy for authenticating with BrowserID.

This module lets you authenticate using BrowserID in your Node.js applications. By plugging into Passport, BrowserID authentication can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.

BrowserID is an open, decentralized protocol for authenticating users based on email addresses, developed by Mozilla. It is commonly associated with Persona, the brand used for Mozilla's implementation of BrowserID. This strategy performs local verification of assertions, delivering on BrowserID's promise of ensuring user privacy.

Install

$ npm install passport-browserid

Usage

Configure Strategy

The BrowserID authentication strategy authenticates users using an assertion of email address ownership, obtained via the BrowserID JavaScript API. The strategy requires a verify callback, which accepts an email address and calls cb providing a user.

passport.use(new BrowserIDStrategy({
    audience: 'http://www.example.com'
  },
  function(email, cb) {
    User.findByEmail({ email: email }, function (err, user) {
      return cb(err, user);
    });
  }
));

Authenticate Requests

Use passport.authenticate(), specifying the 'browserid' strategy, to authenticate requests.

For example, as route middleware in an Express application:

app.post('/auth/browserid', 
  passport.authenticate('browserid', { failureRedirect: '/login' }),
  function(req, res) {
    // Successful authentication, redirect home.
    res.redirect('/');
  });

Considerations

Specification

This module is implemented based on the specifications being developed by Mozilla Identity, which remain a work-in-progress and are not final. Implementers are encouraged to track the progress of these specifications and update update their implementations as necessary. Furthermore, the implications of relying on non-final specifications should be understood prior to deployment.

While the specifications remain under development, it is recommended to use Mozilla's Remote Verification API. This functionality is implemented by passport-persona.

Examples

For a complete, working example, refer to the signin example.

Contributing

Tests

The test suite is located in the test/ directory. All new features are expected to have corresponding test cases. Ensure that the complete test suite passes by executing:

$ make test

Coverage

All new feature development is expected to have test coverage. Patches that increse test coverage are happily accepted. Coverage reports can be viewed by executing:

$ make test-cov
$ make view-cov

Support

Funding

This software is provided to you as open source, free of charge. The time and effort to develop and maintain this project is volunteered by @jaredhanson. If you (or your employer) benefit from this project, please consider a financial contribution. Your contribution helps continue the efforts that produce this and other open source software.

Funds are accepted via PayPal, Venmo, and other methods. Any amount is appreciated.

Credits

• Jared Hanson
• Leo McArdle

License

The MIT License

Copyright (c) 2011-2017 Jared Hanson <http://jaredhanson.net/>

passport-browserid's Issues

BrowserId returns to login page without message

I have tried to implement the BrowserId technique as shown in the examples, but all it does is return to the /login page without giving a message. I've suspected it could be a problem with the connect.csrf I'm using, but I de-activated it and the problem persists. These are my sources:

server = "localhost:8080"

passport.use new BrowserIDStrategy audience: "http://#{server}", (email, done) ->
    user.findOne 'auth.service': 'browserid', 'auth.id': email, (err, user) ->
        if err? then done err
        else if user?
            users.update { _id: user._id }, { $set: 'last-login': new Date }
            done null, user
        else
            name = email.split('@', 2)[0]
            users.insert auth: { id: email, service: 'browserid' }, email: email, name: name, 'created-at': new Date(), 'last-login': new Date(), {safe: yes}, (err, docs) ->
                if err? then done err
                else done null, docs[0]

And the route:

app.post '/auth/browserid', passport.authenticate('browserid', failureRedirect: '/login'), (req, res) ->
    res.redirect '/'

Authentication always fails without reason

I asked the question here: http://stackoverflow.com/questions/12796277/

Basically here is the snippet of code (https://github.com/pathikrit/nemplate) and although I see the persona popup I always get req.isAuthenticated() to be false and it never hits the serialize/deserialize or the callback to the strategy and it fails without any reason

BrowserID is now known as Persona

Hi Jared,

I've been using Passport for a while now, so firstly, many thanks for that. :)

Just thought I'd raise this issue to find out your thoughts first on the BrowserID being renamed to Persona. I forked the project and started doing a pull request but just wondered whether it was the right thing.

Places where things need renaming:

1. links (e.g. http https://browserid.org/include.js is now https://login.persona.org/include.js (to save a redirect))

2. examples/ including views and routes

3. Documentation, ReadMe etc

4. Repository name and package name -> passport-persona

Obviously my pull request will be all of 1, 2 and 3 but I just wanted to check with you your thoughts on whether to rename the repo and the npm package name from passport-browserid to passport-persona.

If you rename the repo and package, then I'll probably wait before submitting my pull request. If you don't rename the repo, I wonder whether having everything referred to as Persona in a repo/package called passport-browserid makes any sense?

Let me know your thoughts. :)

Cheers,
Andy