koa-jwt

Koa JWT authentication middleware.

koa-jwt

Koa middleware that validates JSON Web Tokens and sets ctx.state.user (by default) if a valid token is provided.

This module lets you authenticate HTTP requests using JSON Web Tokens in your Koa (node.js) applications.

See this article for a good introduction.

Install


$ npm install koa-jwt

Usage

The JWT authentication middleware authenticates callers using a JWT token. If the token is valid, ctx.state.user (by default) will be set with the JSON object decoded to be used by later middleware for authorization and access control.

The token is normally provided in a HTTP header (Authorization), but it can also be provided in a cookie by setting the opts.cookie option to the name of the cookie that contains the token. Custom token retrieval can also be done through the opts.getToken option. The provided function is called in the normal Koa context and should return the retrieved token.

Normally you provide a single shared secret in opts.secret, but another alternative is to have an earlier middleware set ctx.state.secret, typically per request. If this property exists, it will be used instead of the one in opts.secret.

Example


var koa = require('koa');
var jwt = require('koa-jwt');
var app = koa();
// Custom 401 handling if you don't want to expose koa-jwt errors to users
app.use(function *(next){
try {
yield next;
} catch (err) {
if (401 == err.status) {
this.status = 401;
this.body = 'Protected resource, use Authorization header to get access\n';
} else {
throw err;
}
}
});
// Unprotected middleware
app.use(function *(next){
if (this.url.match(/^\/public/)) {
this.body = 'unprotected\n';
} else {
yield next;
}
});
// Middleware below this line is only reached if JWT token is valid
app.use(jwt({ secret: 'shared-secret' }));
// Protected middleware
app.use(function *(){
if (this.url.match(/^\/api/)) {
this.body = 'protected\n';
}
});
app.listen(3000);

Alternatively you can conditionally run the jwt middleware under certain conditions:


var koa = require('koa');
var jwt = require('koa-jwt');
var app = koa();
// Middleware below this line is only reached if JWT token is valid
// unless the URL starts with '/public'
app.use(jwt({ secret: 'shared-secret' }).unless({ path: [/^\/public/] }));
// Unprotected middleware
app.use(function *(next){
if (this.url.match(/^\/public/)) {
this.body = 'unprotected\n';
} else {
yield next;
}
});
// Protected middleware
app.use(function *(){
if (this.url.match(/^\/api/)) {
this.body = 'protected\n';
}
});
app.listen(3000);

For more information on unless exceptions, check koa-unless.

You can also add the passthrough option to always yield next, even if no valid Authorization header was found:


app.use(jwt({ secret: 'shared-secret', passthrough: true }));

This lets downstream middleware make decisions based on whether ctx.state.user is set.

If you prefer to use another ctx key for the decoded data, just pass in key, like so:


app.use(jwt({ secret: 'shared-secret', key: 'jwtdata' }));

This makes the decoded data available as ctx.state.jwtdata.

You can specify audience and/or issuer as well:


app.use(jwt({ secret: 'shared-secret', audience: 'http://myapi/protected', issuer: 'http://issuer' }));

If the JWT has an expiration (exp), it will be checked.

This module also support tokens signed with public/private key pairs. Instead of a secret, you can specify a Buffer with the public key:


var publicKey = fs.readFileSync('/path/to/public.pub');
app.use(jwt({ secret: publicKey }));

Related Modules

jsonwebtoken ― JSON Web Token signing and verification

Note that koa-jwt exports the sign, verify and decode functions from the above module as a convenience.

Tests

$ npm install

$ npm test

Author

Stian Grytyr

Credits

This code is largely based on express-jwt.

Auth0

Matias Woloski

Contributors

Foxandxss

soygul

tunnckoCore

getuliojr

cesarandreu

michaelwestphal

sc0ttyd

Jackong

danwkennedy

Licens

The MIT License

wemall 开源微商城 ,微信商城,商城源码,三级分销,微生鲜,微水果,微外卖,微订餐---专业的o2o系统

wemall地址:http://www.wemallshop.com

代码来源:http://js.koahub.com/home/feature/koa-jwt


KoaHub平台基于Node.js开发的Koa JWT认证插件代码信息详情
[该贴被tecentID4913E于2016-10-14 17:54修改过]

本文前端(javascript)相关术语:javascript是什么意思 javascript下载 javascript权威指南 javascript基础教程 javascript 正则表达式 javascript设计模式 javascript高级程序设计 精通javascript javascript教程

主题: Node.js开源微商微信分销外卖
分页:12
转载请注明
本文标题:KoaHub平台基于Node.js开发的Koa JWT认证插件代码信息详情
本站链接:http://www.codesec.net/view/482931.html
分享请点击:


1.凡CodeSecTeam转载的文章,均出自其它媒体或其他官网介绍,目的在于传递更多的信息,并不代表本站赞同其观点和其真实性负责;
2.转载的文章仅代表原创作者观点,与本站无关。其原创性以及文中陈述文字和内容未经本站证实,本站对该文以及其中全部或者部分内容、文字的真实性、完整性、及时性,不作出任何保证或承若;
3.如本站转载稿涉及版权等问题,请作者及时联系本站,我们会及时处理。
登录后可拥有收藏文章、关注作者等权限...
技术大类 技术大类 | 前端(javascript) | 评论(0) | 阅读(35)