hapi-auth-cookie-redis
Redis authentication provides simple session management. The user has to be authenticated via other means, typically a RESTful API, and upon successful authentication the browser receives an authentication cookie.
Subsequent requests containing the cookie are authenticated and validated via the provided validateFunc
in case the user info requires validation on each request.
Quick Start
Installation
npm install --save hapi-auth-cookie-redis
Configuration
The 'redis'
scheme takes the following required options:
param
- the Redis root key for session data storage. Defaults to'auth'
. Change it to something more app-dependent if you have more applications on the same redis instance.host
- the redis server host. Defaults to'127.0.0.1'
port
- the redis server port. Defaults to6379
db
- the default redis db. Defaults to0
password
- the redis auth_pass. Defaults to''
cookie
- the cookie name stored on the client browser. Defaults to'auth'
ttl
- login expire time. Defaults to3600
(seconds),-1
for never, DO NOT use0
validateFunc
- an optional session validation function used to validate the auth token on each request. Used to verify that the internal session state is still valid (e.g. user account still exists). The function has the signature function(request, session, callback) where:- request - is the Hapi request object of the request which is being authenticated.
- session - is the session object set via
request.auth.redis.set(user)
. - callback - a callback function with the signature function(err, isValid, credentials) where:
- err - an internal error.
- isValid - true if the content of the session is valid, otherwise false.
- credentials - a credentials object passed back to the application in request.auth.credentials. If value is null or undefined, defaults to session. If set, will override the current session as if
request.auth.redis.set(user)
was called.
When the redis
scheme is enabled on a route, the request.auth.redis
objects is decorated with the following methods:
- set(value) - sets a specific object on the current session where value is a json object containing all the info about the logged user
- expire() - clears the current session
Run the example
npm install
node example/server
Then visit: http://localhost:3000/example-one
Routes:
- POST
/login
email
and password
required.
Available Users:
[
{
id: 123,
email: 'admin@admin.com',
password: 'admin',
scope: ['user', 'admin', 'user-123']
},
{
id: 124,
email: 'guest@guest.com',
password: 'guest',
scope: ['user', 'user-124']
},
{
id: 125,
email: 'other@other.com',
password: 'other',
scope: ['user', 'user-125']
}
]
-
GET
/logout
-
GET
/example-one
No required authorization.
- GET
/example-two
User
required authorization
- GET
/example-three
Admin
required authorization because the default is admin.
- GET
/example-four/{id}
User specific authorization required.