Package Exports

passport-jwt
passport-jwt/lib
passport-jwt/lib/strategy

This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (passport-jwt) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

Readme

passport-jwt

A Passport strategy for authenticating with a JSON Web Token.

This module lets you authenticate endpoints using a JSON Web token. It is intended to be used to secure RESTful endpoints without sessions.

Install

$ npm install passport-jwt

Usage

Configure Strategy

The jwt authentication strategy is constructed as follows:

new JwtStrategy(options, verify)

options is an object literal containing options to control how the token is extracted from the request or verified.

secretOrKey is a REQUIRED string or buffer containing the secret (symmetric) or PEM-encoded public key (asymmetric) for verifying the token's signature.
issuer: If defined the token issuer (iss) will be verified against this value.
audience: If defined the toekn audience (aud) will be verified against this value.
tokenBodyField: Field in a request body to search for the jwt. Default is auth_token.
tokenHeader: Expected authorization scheme if token is submitted through the HTTP Authorization header. Defaults to JWT
passReqToCallback: If true the request will be passed to the verify callback. i.e. verify(request, jwt_payload, done_callback).

verify is a function with args verify(jwt_payload, done)

jwt_payload is an object literal containing the decoded JWT payload.
done is a passport error first callback accepting arguments done(error, user, info)

An example configuration:

var JwtStrategy = require('passport-jwt').Strategy;
var opts = {}
opts.secretOrKey = 'secret';
opts.issuer = "accounts.examplesoft.com";
opts.audience: "yoursite.net"};
passport.use(new JwtStrategy(opts, function(jwt_paylaod, done) {
    User.findOne({id: jwt_paylaod.sub}, function(err, user) {
        if (err) {
            return done(err, false);
        }
        if (user) {
            done(null, user);
        } else {
            done(null, false);
            // or you could create a new account
        }
    });
}));

Authenticate requests

Use passport.authenticate() specifying 'jwt' as the strategy.

app.post('/profile', passport.authenticate('jwt', { session: false}), 
    function(req, res) {
        res.send(req.user.profile);
    }
);

Include the JWT in requests

The strategy will first check the request for the standard Authorization header.
If this header is present and the scheme matches options.authScheme or 'JWT' if no auth scheme was specified then the token will be retrieved from it. e.g.

Authorization: JWT JSON_WEB_TOKEN_STRING.....

If the an authorization header with the expected scheme is not found the request body will be checked for a field matching options.tokenBodyField or 'auth_token' if the option was not specified.

Tests

$ npm install
$ npm test

License

The MIT License