passport-auth-jwt

A Passport strategy for authenticating with a JSON Web Token.

This module lets you authenticate endpoints using a JSON web token. It is intended to be used to secure RESTful endpoints without sessions.

Install

npm install passport-auth-jwt

Usage

Sorry this is a personal library for locking my system. And I to open the handler requirements.

The flow

User <-> Device <-> Provider

Note:

• User This is your user
• Device This is your application/website
• Provider This is your system, RESTful endpoint

Configure

/**
* Config
*/
var passport = require('passport');
var passportAuthJWT = require('passport-auth-jwt');
config.passport.hook = require('./helper/auth-jwt-hook');
var PassportMoney = new passportAuthJWT(config.passport);
passport.use(PassportMoney.strategy());

// config.passport

{
			clientId: 'client_id',
			extractJwtOpts: {
				authScheme: 'AuthJWT',
				tokenBodyField: 'access_token',
				tokenQueryParameterName: 'access_token'
			},
			requestTokenEndpoint: '/auth/request-token',
			refreshTokenEndpoint: '/auth/refresh-token',
			tokenEndpoint: '/auth/token',
			ignoreRequestTokenUrl: ['/'],
			secret: '5f2c6556-2483-4254-a0e6-d8aec4069caa',
			accessTokenExpire: 7 * 86400, // 7 days = 7 * 24 * 3600;
			refreshTokenExpire: 10 * 365 * 86400, // 10 year
			requestTokenExpire: 3600 // 1h
		}

// ./helper/auth-jwt-hook

'use strict';

const mongoose = require('mongoose');
const uuid = require('node-uuid');
const jwt = require('jsonwebtoken');
const async = require('async');
const moment = require('moment');
const _ = require('lodash');

const PassportError = function (done, err) {
	if (err) {
		console.log(err);
	}

	return done({error: err}, false);
};

const ClientSchema = mongoose.model('ClientKey');
const UserSchema = mongoose.model('User');
const RefreshTokenSchema = mongoose.model('RefreshToken');

const Error = require('../config/error');

// restify get path;
var getPath = function (req) {
	return req.route ? req.route.path : req.path;
};

var urlRequireForRequestToken = ['/auth/token', '/facebook-register', '/google-register', '/register', '/forgot-password'];

var AuthJWTHook = {
	verify: function (config) {
		return function (req, jwt_payload, done) {
			console.log('payload', jwt_payload);

			// Logic
			if (req.authenticate.client === jwt_payload.client_id) {
				switch (jwt_payload.type) {
					case 'request-token':
						AuthJWTHook._verifyRequestToken(req, jwt_payload, done, config);
						break;
					case 'refresh-token':
						AuthJWTHook._verifyRefreshToken(req, jwt_payload, done, config);
						break;
					case 'access-token':
						done(null, jwt_payload);
						break;
					default:
						PassportError(done);
				}
			} else {
				PassportError(done);
			}
		}
	},

	// Set userId to req
	passportCallback: function (req, res, next) {
		return function (err, user, info) {
			if (user) {
				req.userId = user.userId;
				next();
			} else {
				next(err || info);
			}
		};
	},

	requestTokenCallback: function (req, res, next) {
		return function (error, token) {
			res.send(token);
		}
	},

	/*
	 more in req
	 req.authenticate = {
	 client: '14235l4tjgksdsjdlkfs',
	 secret: '3o432492rjfksdfjslkdfjsdkl'
	 };

	 */
	generateRequestToken: function (req, res, next, config) {
		var clientInfo = req.authenticate;

		ClientSchema.findOne({
			client: clientInfo.client,
			secret: clientInfo.secret,
			isDisabled: false
		}, function (error, client) {
			if (client) {
				var token = AuthJWTHook._generateJWTToken(
					'request-token', config.secret, `${config.requestTokenExpire}s`, {
						clientId: client._id,
						client_id: client.client
					}
				);
				res.send({status: true, request_token: token});
			} else {
				res.send({
					status: false,
					message: Error['OAUTH_ERROR_CLIENT_SECRET_NOT_VALIDATE']
				});
			}
		});
	},

	generateAccessToken: function (req, res, next, config) {
		// Logic for generate token
		return function (error, tokenInfo) {
			if (tokenInfo && tokenInfo.type === 'request-token') {
				var client_id = tokenInfo.client_id;
				var clientId = tokenInfo.clientId;
				var postData = req.body;

				AuthJWTHook._login(clientId, client_id, postData, config, function (error, data) {
					if (error) {
						res.send({
							status: false,
							message: error
						});
					} else {
						res.send({
							status: true,
							access_token: data.access_token,
							expire: data.expire,
							refresh_token: data.refresh_token
						});
					}
				});
			} else {

				res.send({
					status: false,
					message: Error['OAUTH_ERROR_CLIENT_SECRET_NOT_VALIDATE']
				});
			}
		};
	},

	generateRefreshToken: function (req, res, next, config) {
		return function (error, tokenInfo) {
			if (tokenInfo && tokenInfo.type === 'refresh-token') {
				AuthJWTHook._generateToken(
					tokenInfo.clientId,
					tokenInfo.client_id,
					tokenInfo.userId,
					config.secret,
					tokenInfo.key,
					config,
					function (error, results) {
						if (error) {
							res.send({
								status: false,
								message: Error['']
							});
						} else {
							res.send({
								status: true,
								access_token: results.access_token.token,
								expire: results.access_token.expire,
								refresh_token: results.refresh_token
							});
						}
					},
					tokenInfo.deviceKey
				);
			} else {
				res.send({
					status: false,
					message: Error['OAUTH_ERROR_CLIENT_SECRET_NOT_VALIDATE']
				});
			}
		};
	},

	_generateToken: function (clientId, client_id, userId, secret, key, config, callback, deviceKey) {
		async.parallel({
			refresh_token: function (callback) {
				AuthJWTHook._createRefreshToken(
					clientId, client_id, userId, secret, config, callback, deviceKey
				);
			},
			access_token: function (callback) {
				AuthJWTHook._createAccessToken(
					clientId, client_id, userId, secret, config, callback, deviceKey
				);
			},
			clean_refresh_token: function (callback) {
				if (key) {
					AuthJWTHook._cleanRefreshToken(key, callback);
				} else {
					callback(null, true);
				}
			}
		}, callback);
	},

	_createRefreshToken: function (clientId, client_id, userId, secret, config, callback, deviceKey) {
		var key = uuid.v4();

		var token = AuthJWTHook._generateJWTToken('refresh-token', secret, `${config.refreshTokenExpire}s`, {
			clientId: clientId,
			client_id: client_id,
			userId: userId,
			key: key,
			deviceKey: deviceKey
		});

		// logic more...
	},

	_cleanRefreshToken: function (key, callback) {
		// Logic for clean refresh token

	},

	_createAccessToken: function (clientId, client_id, userId, secret, config, callback, deviceKey) {
		var attachInfo = {
			clientId: clientId,
			client_id: client_id,
			userId: userId,
			code: deviceKey
		};

		var token = AuthJWTHook._generateJWTToken('access-token', secret, `${config.accessTokenExpire}s`, attachInfo);

		callback(null, {
			token: token,
			expire: AuthJWTHook._getExpire(config.accessTokenExpire)
		});
	},

	_verifyRequestToken: function (req, jwt_payload, done, config) {
		if (urlRequireForRequestToken.indexOf(getPath(req)) > -1) {
			done(null, jwt_payload);
		} else {
			PassportError(done);
		}
	},

	_verifyRefreshToken: function (req, jwt_payload, done, config) {
		// Valid refresh token

		console.log('OK');

		if (config.refreshTokenEndpoint === getPath(req) && jwt_payload.deviceKey) {
			// Logic for verufy refresh token
		} else {
			console.log(error);
			PassportError(done, error);
		}
	},

	_generateJWTToken: function (type, secret, expire, extraData) {
		extraData = extraData || {};

		var token_payload = {
			type: type,
			code: uuid.v4()
		};

		token_payload = Object.assign(token_payload, extraData);

		return jwt.sign(token_payload, secret, {
			expiresIn: expire
		});
	},

	_getExpire: function (day) {
		return moment().add(day, 's').format('X');
	},

	_login: function (clientId, client_id, postData, config, callback) {
		// Login function....
		AuthJWTHook._generateToken(...)
	}
};

module.exports = AuthJWTHook;

Authenticate requests

Use PassportMoney.authenticate() specifying 'JWT' as the strategy.

app.post('/profile', PassportMoney.authenticate({ session: false}),
    function(req, res) {
        res.send(req.user.profile);
    }
);

If you have any questions please create issues on Github. I will try to help