Authentication With PassportJS

What is Passport?

 

Passport is Express-compatible authentication middleware for Node.js, which is used to authenticate requests.

 

It uses plugins called 'Strategies' to authenticate requests. We can implement custom strategies too. It is so flexible and allows application level decisions. It supports persistent sessions also.

 

Here we can see how to implement passport authentication with some example strategies.

 

Installation

 

npm install passport

 

To initialize a passport we use passport.initialize() middleware and passport.session() middleware must be used for persistent login sessions.

 

The middlewares can be used on app configuration like this,

app.use(passport.initialize());
app.use(passport.session());

To authenticate a request passport.authenticate() middleware can be used with a particular strategy.

 

After authentication success, a session is established and maintained via a cookie set in the user's browser. serializeUser will serialize the user to the session and deserializeUser will deserialize user id from the session.

 

Code example

passport.serializeUser(function(user, done) {
    done(null, user.id);
});
passport.deserializeUser(function(id, done) {
    User.where({
        id: id
    }).fetch().then(user => {
        done(null, user);
    });
});

Strategies used,

 

There are a set of over 480 authentication strategies used, including

• Local,
• openId,
• Facebook,
• Google,
• JWT

Among them, we will see 2 strategies for authentication.

1. JWT strategy
2. Local strategy

JWT strategy

 

This is the strategy used for authenticating users with a jwt token.

 

Installation

 

npm install passport-jwt

 

Usage

 

It uses options to control how the token is extracted from the request. Extractors are used to extract JWT from the request.

 

Possible Extractors used,

• fromAuthHeaderWithScheme(auth_scheme) - will expect the scheme to match auth_scheme and looks for JWT from authorization header
• fromHeader(header_name) - looks for the JWT in the given http header
• fromBodyField(field_name) - get JWT from the body

Code example

let JwtStrategy = require('passport-jwt').Strategy;
let {
    ExtractJwt
} = require('passport-jwt');
const opts = {}; //options
opts.jwtFromRequest = ExtractJwt.fromAuthHeaderWithScheme('jwt'); // Extractor
opts.secretOrKey = jwtSecret;
opts.ignoreExpiration = true;
passport.use('jwt', new JwtStrategy(opts, function(jwt_payload, done) {
    return User.forge({
        id: jwt_payload.id
    }).fetch().then(user => done(null, user)).catch(err => done(err, false));
}));

jwt_payload is the object literal containing the decoded JWT payload.

 

To authenticate requests, we need to specify 'jwt' as a strategy.

passport.authenticate('jwt', { session: false })

This will first check the request for the standard Authorization header. If the header scheme matches 'JWT' then the token will be retrieved from it. e.g.:

 

Authorization: JWT web_token

 

Here we have disabled the session making it to false.

 

Passport Local

 

This is the strategy for authenticating users with a username and password.

 

Installation

 

npm install passport-local

 

Usage

 

By default, LocalStrategy expects username and password parameters parameters from credentials. But options are available to change the field names.

 

Code Example

let LocalStrategy = require('passport-local').Strategy;
passport.use(new LocalStrategy({
    usernameField: 'username',
    passwordField: 'password'
}, function(username, password, done) {
    return user.forge({
        name: username
    }).fetch().then(user => {
        if (err) {
            done(err, null)
        };
        if (!user) {
            done(null, false);
        };
        if (user.verifyPassword(password)) {
            done(null, user);
        } else {
            done(null, false);
        }
    }).catch(err => done(err, false));
}));

To authenticate requests, we need to specify ‘local’ as a strategy.

passport.authenticate('local', { failureRedirect: '/login', successRedirect: '/ })

failureRedirect and successRedirect are commonly issued after authenticating a request. And flash options also can be implemented as failureFlash, successFlash.

Instead of sending options we can define a custom callback also.

 

Code example

passport.authenticate('local', function(err, user, info) {
   // required codes
})(req, res, next);