How to format a request with JSON web tokens about nodebb-plugin-write-api

[codecowboy]

Do the params need to be encoded into the web token? If so that won't work for me either. I'd like to connect to the API from the IFTTT Maker channel which doesn't allow manipulation of the Http Headers

[julianlam]

Hi @codecowboy -- the payload values need to be embedded in the web token itself. No manipulation of th HTTP headers is required when using JWT.

[codecowboy]

@julianlam thanks. I was looking at hitting the API from a webhook which is part of the IFTTT Maker channel. Unfortunately I would need to pass the bearer token as part of the request body as there is no provision for encoding a JWT or setting a header.

From lib/node_modules/passport-http-bearer/strategy.js it looks like you have disabled this option somehow:

  if (req.body && req.body.access_token) {
    if (token) { return this.fail(400); }
    token = req.body.access_token;
  }

  if (req.query && req.query.access_token) {
    if (token) { return this.fail(400); }
    token = req.query.access_token;
  }

  if (!token) { return this.fail(this._challenge()); }

Is that the case? tried altering that code but didn't get anywhere.

[julianlam]

I didn't modify http-bearer (you'll notice it's not in the repo files). You'll need to encode the payload in the actual POST payload or GET querystring parameter.

[codecowboy]

Hmmm, I am confused then. I see now that you are pulling in passport-http-bearer as a dependency - apologies.

I guess this comment in that file is just wrong and they took this functionality out:

 * The HTTP Bearer authentication strategy authenticates requests based on
 * a bearer token contained in the `Authorization` header field, `access_token`
 * body parameter, or `access_token` query parameter.

I've tried both access_token in the query string and the post body and it doesn't work.

[codecowboy]

For anyone else having this issue, I also posted here - jaredhanson/passport-http-bearer#42

[julianlam]

@codecowboy Are you still experiencing issues getting the token parsed?

[codecowboy]

@julianlam you can probably close this. I wrote a script which sets the appropriate headers for me.