JWT token auth for express.js

This package provides JSON Web Token Authentication support for Express. It will conveniently set req.user for authenticated requests. The authorization header is in the from of:

Authorization JWT < jwt token > 

New to using JSON Web Tokens? Take a look at these resources:

• JWT.io
• JSON Web Token Abstract
• Token based authentication with Socket.io

Installation

npm install express-jwt-token

Usage

var express = require('express')
  , auth = require('express-jwt-token')
  , app = express()
  , router = express.Router()


// Require jwt authorization on all routes
router.all('*', auth.jwtAuthProtected)

// Require jwt authorization on only api routes
router.all('/api/*', auth.jwtAuthProtected)

// Require jwt auth on a specific route
router.get('/auth-protected', auth.jwtAuthProtected, function(req, res){
  res.send({'msg': 'Im jwt auth protected!'})
})

app.use('/', router)
app.listen(3000)

Now your route(s) are protected and require an authorization header in the form of:

Authorization JWT < jwt token > 

Configuration

Configure your JWT Secret. This must be changed for production. Default value is 'secret'.

process.env.JWT_SECRET_KEY = 'Your Secret'

Configure the authorization header prefix. this is optional. Default is 'JWT'.

process.env.jwtAuthHeaderPrefix

Provided Middleware

ensureAuthorizationHeader

An Express.js middleware that ensures that a request has supplied an authorization header.

• @param {object} req
• @param {object} res
• @param {function} next

validateJWTAuth

An Express.js middleware validates a JWT token.

• @param {object} req
• @param {object} res
• @param {function} next

ensureAuthorized

An Express.js middleware that ensures that a request has supplied an authorization header.

• @param {object} req
• @param {object} res
• @param {function} next

jwtAuthProtected

The grouped middleware needed to enforce jwt Auth. Mounts the same as a single middleware.

Errors

When authorization fails express-jwt-token will return an UnauthorizedError with some helpful details about what went wrong.

This implementation was based on the excellent django-rest-framework-jwt library.