README
koa-jwt-passbook
Koa middleware that validates JSON Web Tokens and sets ctx.user
(by default) if a valid token is provided.
This module lets you authenticate Apple Passbook-related HTTP requests using JSON Web Tokens in your Koa (node.js) applications. It also verifies the Pass Type Identifier and Serial Number associated with a pass and token.
See this article for a good introduction to JWTs and this page for Apple's Passbook Web Service Reference.
Install
$ npm install koa-jwt-passbook
Usage
The JWT authentication middleware authenticates callers using a JWT
token. If the token is valid, ctx.user (by default) will be set
with the JSON object decoded to be used by later middleware for
authorization and access control.
Every JWT must have the typeId and serial properties in its payload for verification
of the Pass Type Identifier and Serial Number, respectively. Before token verification,
the ctx.passData must be set to an object with typeId and serial properties to
compare the request's token payload against.
Example
var koa = require('koa');
var Router = require('koa-router');
var mount = require('koa-mount');
var jwt = require('koa-jwt-passbook');
var app = koa();
// Custom 401 handling
app.use(function *(next) {
try {
yield next;
} catch (err) {
if (401 === err.status) {
this.status = 401;
this.body = 'Access Denied to protected resource. Use Authorization header to get access ("Authorization: ApplePass <token>").\n';
} else {
throw err;
}
}
});
var unprotected = new Router();
unprotected.get('/', function* () {
this.body = 'unprotected\n';
});
app.use(mount('/public', unprotected.middleware()));
var api = new Router();
api.get('/:typeId/:serial', function* (next) {
// Get params before yielding to JWT handler
this.passData = {
typeId: this.params.typeId,
serial: this.params.serial
};
yield next;
// After JWT handler
this.body = 'protected\n';
});
app.use(mount('/api', api.middleware()));
app.use(mount('/api', jwt({ secret: 'secret' })));
app.listen(3000);
Alternatively, you can add the passthrough option to always yield next,
even if no valid Authorization header was found:
app.use(jwt({ secret: 'shared-secret', passthrough: true }));
This lets downstream middleware make decisions based on whether ctx.user is set.
If you prefer to use another ctx key for the decoded data, just pass in key, like so:
app.use(jwt({ secret: 'shared-secret', key: 'jwtdata' }));
This makes the decoded data available as ctx.jwtdata.
You can specify audience and/or issuer as well:
app.use(jwt({ secret: 'shared-secret',
audience: 'http://myapi/protected',
issuer: 'http://issuer' }));
If the JWT has an expiration (exp), it will be checked.
This module also support tokens signed with public/private key pairs. Instead of a secret, you can specify a Buffer with the public key:
var publicKey = fs.readFileSync('/path/to/public.pub');
app.use(jwt({ secret: publicKey }));
Related Modules
- jsonwebtoken — JSON Web Token signing and verification
Note that koa-jwt exports the sign, verify and decode functions from the above module as a convenience.
Also note that verify is thunkified to play nice with co/koa.
Tests
$ npm install
$ npm test
Author
Jarrod Davis
Credits
This is a fork of koa-jwt by Stian Grytøyr, which is largely based on express-jwt.