Vibrant Auth Middleware for Nest.js

A Nest.js middleware for authenticating users with JWT.

Installation

npm install vibrant-auth-middleware-nodejs cookie-parser

Features

• Supports HS256 and RS256 JWT algorithms.
• Retrieves token from access_token cookie (requires token_type cookie to be 'Bearer') or Authorization header.
• Easy integration with Nest.js applications.
• Configurable with secrets or public keys.

Usage

Import AuthModule into your application module. You must provide both a HS256 secret and an RS256 public key.

import { Module } from '@nestjs/common';
import { AuthModule } from 'vibrant-auth-middleware-nodejs';

@Module({
  imports: [
    AuthModule.forRoot({
      hs256_secret: 'your-hs256-secret',
      rs256_public_key: 'your-rs256-public-key',
    }),
  ],
})
export class AppModule {}

Authentication with AuthGuard (Recommended for HTTP & gRPC)

Use AuthGuard for unified support across HTTP and gRPC contexts.

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AuthGuard } from 'vibrant-auth-middleware-nodejs';

@Controller('users')
@UseGuards(AuthGuard)
export class UserController {
  @Get('profile')
  getProfile() {
    // User is authenticated
  }
}

Authentication with Middleware (HTTP Only)

Apply the AuthMiddleware to your routes. You will also need to use the cookie-parser middleware.

import { Module, NestModule, MiddlewareConsumer } from '@nestjs/common';
import { AuthMiddleware } from 'vibrant-auth-middleware-nodejs';
import * as cookieParser from 'cookie-parser';

@Module({})
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(cookieParser(), AuthMiddleware)
      .forRoutes('protected-route');
  }
}

Accessing User Information

The availability of the user object depends on the execution context:

• HTTP Context: The decoded user information is attached to the request object (req.user).
• RPC Context: The token is validated, but the user information is NOT attached to the context or data stream automatically. You should handle user identification within your business logic if needed.

HTTP Headers

The middleware/guard looks for the Authorization header with the Bearer scheme:

Authorization: Bearer <your_jwt_token>

HTTP Cookies

If using cookies, BOTH cookies are required:

1. access_token: The JWT token.
2. token_type: Must be set to Bearer.

Example (Setting cookies in Express/NestJS):

res.cookie('access_token', token, { httpOnly: true });
res.cookie('token_type', 'Bearer', { httpOnly: true });

gRPC Metadata

For gRPC requests, the Authorization metadata key is checked:

const metadata = new Metadata();
metadata.add('Authorization', 'Bearer <your_jwt_token>');

The AuthModule.forRoot() method accepts a configuration object with the following properties:

• hs256_secret (string): The secret key for HS256. This is a required field.
• rs256_public_key (string): The public key for RS256. This is a required field.

License

This project is licensed under the ISC License.