hapi-auth-cookie-redis

    2.0.0 • Public • Published

    hapi-auth-cookie-redis

    Redis authentication provides simple session management. The user has to be authenticated via other means, typically a RESTful API, and upon successful authentication the browser receives an authentication cookie.

    Subsequent requests containing the cookie are authenticated and validated via the provided validateFunc in case the user info requires validation on each request.

    Quick Start

    Installation

    npm install --save hapi-auth-cookie-redis
    

    Configuration

    The 'redis' scheme takes the following required options:

    • param - the Redis root key for session data storage. Defaults to 'auth'. Change it to something more app-dependent if you have more applications on the same redis instance.
    • host - the redis server host. Defaults to '127.0.0.1'
    • port - the redis server port. Defaults to 6379
    • db - the default redis db. Defaults to 0
    • password - the redis auth_pass. Defaults to ''
    • cookie - the cookie name stored on the client browser. Defaults to 'auth'
    • ttl - login expire time. Defaults to 3600 (seconds), -1 for never, DO NOT use 0
    • validateFunc - an optional session validation function used to validate the auth token on each request. Used to verify that the internal session state is still valid (e.g. user account still exists). The function has the signature function(request, session, callback) where:
      • request - is the Hapi request object of the request which is being authenticated.
      • session - is the session object set via request.auth.redis.set(user).
      • callback - a callback function with the signature function(err, isValid, credentials) where:
        • err - an internal error.
        • isValid - true if the content of the session is valid, otherwise false.
        • credentials - a credentials object passed back to the application in request.auth.credentials. If value is null or undefined, defaults to session. If set, will override the current session as if request.auth.redis.set(user) was called.

    When the redis scheme is enabled on a route, the request.auth.redis objects is decorated with the following methods:

    • set(value) - sets a specific object on the current session where value is a json object containing all the info about the logged user
    • expire() - clears the current session

    Run the example

    npm install 
    node example/server
    

    Then visit: http://localhost:3000/example-one

    Routes:

    • POST /login

    email and password required.

    Available Users:

    [
      {
        id: 123,
        email: 'admin@admin.com',
        password: 'admin',
        scope: ['user', 'admin', 'user-123']
      },
      {
        id: 124,
        email: 'guest@guest.com',
        password: 'guest',
        scope: ['user', 'user-124']
      },
      {
        id: 125,
        email: 'other@other.com',
        password: 'other',
        scope: ['user', 'user-125']
      }
    ]
    
    • GET /logout

    • GET /example-one

    No required authorization.

    • GET /example-two

    User required authorization

    • GET /example-three

    Admin required authorization because the default is admin.

    • GET /example-four/{id}

    User specific authorization required.

    Install

    npm i hapi-auth-cookie-redis

    DownloadsWeekly Downloads

    0

    Version

    2.0.0

    License

    MIT

    Unpacked Size

    22.7 kB

    Total Files

    12

    Last publish

    Collaborators

    • antoniogiordano