Authentication Middleware

A simple (opinionated) connect-style authentication middleware.

This middleware directly use jws package to implement a simpler version of JsonWebToken to authenticate the users via cookie or the Authentication header.

Readers can read the source code to get the idea and replace the token encode/decode mechanism with jsonwebtoken, or use this package directly. This package does not follow the standard of jsonwebtoken. However, it is well tested in it owns implementation.

Usage sample

const express = require('express')
const connectAuthentication = require('connect-authentication').default
const cookieParser = require('cookie-parser')
const asyncMiddleware = require('middleware-async').default
const bodyParser = require('body-parser')

const user = {id: '1', first: 'hello', last: 'world', username: 'admin'}
const encode = u => u.id
const decode = id => id === '1' && user
const app = express()
app.use(
		cookieParser('cookie-secret'),
		connectAuthentication(encode, decode, 'jws-secret')
)
app.get('/', (req, res) => res.status(200).send('hello world!'))
app.post('/login',
		bodyParser.json(),
		asyncMiddleware(async (req, res) => {
				const {body: {username, password}} = req
				if (username === 'admin' && password === 'password') {
						const token = await req.login(user)
						res.status(200).json(token)
				} else res.status(401).json({error: 'wrong credential'})
		})
)
app.get('/me', (req, res) => {
		if (req.user) res.status(200).json(req.user)
		else res.status(403).json({error: 'please login'})
})
app.get('/logout', asyncMiddleware(async (req, res) => {
		await req.logout()
		res.send('logout success')
}))
app.listen(3000, () => console.log('Server is listening at port 3000'))

API Reference

Interface of the default export

export default function connectAuthentication<IUser, IPayload>(
		encode: (user: IUser) => CanAwait<IPayload>,
		decode: (payload: IPayload) => CanAwait<IUser | undefined>,
		secret: string | Buffer,
		{
				ttl = '1 week',
				alg = 'HS256',
				encoding = 'utf8',
				cookieKey = 'jwt',
				isTokenRevoked,
				revokeToken,
				cookieOptions = {
						httpOnly: true,
						sameSite: 'lax',
						secure: true,
						signed: false,
				},
		}: {
				ttl?: number | string
				alg?: Algorithm
				encoding?: string
				cookieKey?: string | false
				isTokenRevoked?: (token: string) => CanAwait<boolean>
				revokeToken?: (token: string, expire: Date) => CanAwait<void>
				cookieOptions?: CookieOptions
		} = {}
): RequestHandler