mali-jwt
Mali JWT authentication middleware.
https://github.com/malijs/mali middleware that validates JSON Web Tokens and sets ctx.user
(by default) if a valid token is provided.
Install
$ npm install mali-jwt
Usage
The JWT authentication middleware authenticates callers using a JWT
token. If the token is valid, ctx.user
(by default) will be set
with the JSON object decoded to be used by later middleware for
authorization and access control.
Retrieving the token
The token is normally provided in call metadata Authorization
property
using bearer
scheme; but custom token retrieval can also be done through the
getToken
option. The provided function should match the following interface:
/** * Your custom token resolver * @this The ctx object passed to the middleware * * @param * @return */
The resolution order for the token is the following. The first non-empty token resolved will be the one that is verified.
opts.getToken
function- check the Authorization metadata property for a bearer token
Passing the secret
Normally you provide a single shared secret in opts.secret
, but another
alternative is to have an earlier middleware set ctx.secret
,
typically per request. If this property exists, it will be used instead
of the one in opts.secret
.
Checking if the token is revoked
using isRevoked
option you can provide a async function to jwt for it check
the token is revoked. The provided function should match the following interface:
/** * Your custom isRevoked resolver * * @param * @param * @param * @return */
Options
key
- the path to set decoded JSON object intoctx
. Default:user
.secretPath
- the path withinctx
to look for the secret. If not present at path usesopts.secret
. Default:secret
.isRevoked
- Async function for checking if token is revoked.getToken
- Optional function for getting token.tokenPath
- Optional path for to place token withinctx
.
Example
// Middleware below this line is only reached if JWT token is validapp // Protected middlewareapp
// Middleware below this line is only reached if JWT token is validapp // Protected middlewareapp
// Get the token using a custom getToken functionapp // Protected middlewareapp
Credits
Based on koa-jwt
License
Apache 2.0