Share your code. npm Orgs help your team discover, share, and reuse code. Create a free org »


    Derby.js Authentication

    NOTE: Please use the 0.5 branch if you're using Derby/Racer 0.5

    Provides authentication middleware (using Passport) for use in your Derby projects.

    Please use the example directory as boilerplate for setting up your own project, but the basics are outlined here.

    Step 1

    Setup a hash of strategies you'll use - strategy objects and their configurations
    Note, API keys should be stored as environment variables (eg, process.env.FACEBOOK_KEY) or you can use nconf to store
    them in config.json, which we're doing here
    auth = require("derby-auth")
    strategies =
        strategy: require("passport-facebook").Strategy
          clientID: conf.get('fb:appId')
          clientSecret: conf.get('fb:appSecret')

    Step 1.5

    Optional parameters passed into auth.middleware(). Most of these will get sane defaults, so it's not entirely necessary
    to pass in this object - but I want to show you here to give you a feel. @see derby-auth/ for options
    options =
        failureRedirect: '/'
        successRedirect: '/'
        domain: 'http://localhost:3000'
        name: 'My Site'
        email: ''
        service: 'Gmail'
        user: ''
        pass: 'abc'

    Step 2

    Initialize the store. This will add utility accessControl functions (see for more details), as well
    as the basic specific accessControl for the `auth` collection, which you can use as boilerplate for your own `users`
    collection or what have you. The reason we need `mongo` & `strategies` is to run db.ensureIndexes() on first run,
    and we may need in the future to access sensitive auth properties due to missing mongo projections feature
    in Racer 0.5 (@see

    Step 3

    Make sure your express app is using sessions & body-parsing

            secret: conf.get('SESSION_SECRET')
            store: new MongoStore({url: mongoUrlsafe: true})

    Use derby-auth's mounted middleware

        # derbyAuth.middleware is inserted after modelMiddleware and before the app router to pass server accessible data to a model 
        # Pass in {store} (sets up accessControl & queries), {strategies} (see above), and options 

    Step 4 (optional, recommended)

    If you want drop-in Login and Register forms, including form validation, use the <derby-auth:login /> and <derby-auth:register /> components. To enable these, you'll need this in your /src/app/ file:

       app.use require("derby-auth/components/")

    NOTE: the components require jQuery in your app (window.$ must exist). See example/server/'s store.on('bundle') for an example.

    See the example for more details, as well as login / registration forms, sign-in buttons, etc.

    Why not EveryAuth?

    This project was originally implemented with Everyauth (see branch), but had some issues:

    1. Every provider had to be implemented individually in code. Passport has an abstraction layer, which is what allows us to pass in Strategy + conf objects in server/index.js for every provider we want enabled.
    2. Password authentication posed technical difficulties. See the Google Group discussion

    The derby-examples/auth folder, written by the creators of Derby, uses Everyauth - so if you can't get derby-auth working, you may want to give that a shot. Note, it doesn't yet implement username / password authentication.




    npm i derby-auth2

    Downloadsweekly downloads








    last publish


    • avatar