kerncheh / express-header-token-auth

Parses Authorization Headers from an Express request object for an authorization token.

Express Header Token Authentication

This package parses Authorization headers from an Express request object for an authorization token.

Installation

npm install express-header-token-auth

Usage

Token validation can be done through a routing middleware or part of the routed action.

Incoming Payload can be simulated by:

curl -IH "Authorization: Token token=test;param1=option1;param2=option2" http://myapp.com/protected/resource

Accepted Authorization Header formats are:

Authorization: Token token=test,param1=option1,param2=option2
Authorization: Token token="test",param1="option1",param2="option2"
//Any variation of commas(,), semicolons(;) or tabs(   ) are accepted as delimiters

As routing middleware

router.use('/protected/resource', function(req, res, next) {
  new TokenAuth(req, res).authenticateOrRequestWithHttpToken(function(err, token, options) {
    if (!err) {
      if (isValidToken(token, options))
        next();
      else {
        // send out invalid response
      }
    }
    // `else` case is not needed. If `err` is present, a HTTP response with status 401 will automatically be sent out.
  });
});

As action

router.get('/protected/resource', function(req, res, next) {
  new TokenAuth(req, res).authenticateOrRequestWithHttpToken(function(err, token, options) {
    if (!err) {
      if (isValidToken(token, options))
        // valid response
      else {
        // send out invalid response
      }
    }
    // `else` case is not needed. If `err` is present, a HTTP response with status 401 will automatically be sent out.
  });
});

Methods

authenticateOrRequestWithHttpToken([realm], callback)

Used to grab token and options from callback. When token is not found, HTTP status 401 challenge is automatically sent. The realm parameter defaults to Application, which is used when challenging for token.

authenticate(callback, [callbackOnError])

Similar to authenticateOrRequestWithHttpToken, except the HTTP status 401 challenge will not be sent on failure to identify token. User is responsible for deciding the next course of action. The callbackOnError parameter defaults to true and should rarely be needed.

requestHttpTokenAuthentication(realm)

Issues HTTP Status 401 challenge to current Response object.