How to use JWT with passport.js

#Content table:

• Preface
• Installation
• Create the authentication router
• Implementation of a JWT protected router
• Test the JWT authentication and authorization
• Conclusions
• A few words about https and http
• all the code files /routers/auth.js, /routers/users.js, /app/passport.js and app.js
• Resources

 

#Preface

JWT is a json web token. It is used for authentication between server and client. So to implement it in a node.js we are going to use such modules:

1. passport – to set up log in middleware
2. passport-local – to create a user authentication router
3. passport-jwt – to create a user authorization router
4. jsonwebtoken – to generate a JWT itself

So let’s get started.

 

#Installation

we have to install four this module

 

#Create the authentication router.

We need a router where a user will send username and password and we will check it and send back a JWT. To implement this we’ll need a passport and its passport.authentication middleware where we use a passport-local.

let’s create a file /routers/auth.js

 

and include somewhere in the app.js

 

here is

req.login is a passport function which logs in the user it accepts callback function where we generate jwt by using a nodejs module jsonwebtoken

 

we need a your_jwt_secret and this function jwt.sign accept a lot of parameters

 

here is a call passport.authenticate function where we apply a “local” as a first parameter that will invoke a passport-local strategy and its strategy will have a code of authentication users. So let’s implement this piece of code

 

Let’s create a file /app/passport.js

passport.use is a function, which accepts strategies, in this case, LocalStrategy and a callback function where we pass username, password and a callback function done. Here should be a lookup to the database or whatever for username and password and compare with a passed username and password and if they equal we’ll return a callback done with a user.

Ok, so far so good! We have an authentication router which generates and return a JWT token. The next we need to create a protected router where users will send their requests with tokens and get resources

 

#Implementation of a JWT protected router

A router will have a url site.com/users/*. Everything being requested to site.com/users/* will require JWT authentication. To realize JWT authentication we’are going to use passport-jwt strategy. So let’s add the strategy to the /app/password.js file where is already a local strategy

a file /app/passport.js

 

we need ExtractJWT which is a special object of a passport-jwt strategy

which helps us extract a jwt token from the request

The token uses a bearer header. It’s a special header which is used to pass a JWT from a client to a server, they are nothing special but text. As we can see there is a special function fromAuthHeaderAsBearerToken to get it.

 

JWTStrategy accepts a unanimous callback function, which accepts two arguments jwtPayload and callback done to send the data to the user. Here we can do a lookup to the database to find additional user parameters or not if you enough from the payload.

So, the next left to create a router itself.

Let’s create a file /routers/users.js

here is nothing special to explain.

 

Now, let’s include the file to the express middleware.

Somewhere in the app.js

here is we add a passport.authenticate middleware function before including the router. As you can see it uses ‘jwt‘ authenticate strategy that was already be created in the /app/passport.js file.

That’s it!

 

#Test the JWT authentication and authorization

We’ll be using a postman to test, here is an animation how it is going on

 

#Conclusions

So now, everything should work. We created the authenticate login router and the protected router.
The authenticate login router uses passport-local strategy and the protected router uses passport-jwt strategy.
The authenticate login router generates a JWT token by using a nodejs module jsonwebtoken
Clients have to pass the token as a bearer header and it will be extracted in the protected router in the passport-jwt authentication callback function. So that’s it! A simple JWT + passport.js authentication is done.

 

#A few words about https and http

It is inappropriate to use JWT token over http. Why? Because somebody in the middle can get the token as http passes data as plain text. Using JWT token everybody can connect to the protected router. So we have to encrypt the passed data by using https. https encrypts everything even headers so that the JWT token is protected.

Always use https with JWT. Never pass data as plain text

 

#all the code files /routers/auth.js, /routers/users.js, /app/passport.js and app.js

Показать »

 

#Resources:

1. Learn using JWT with Passport authentication
2. jsonwebtoken
3. passport.js
4. jwt.io

 

 

the end