@cjhowe7/hapi-auth-jwt

A simple, opinionated Hapi 17 authentication scheme for JWT

Introduction

Hapi 17 is pretty great, but a lot of libraries haven't updated to the latest version. The JWT authentication scheme is something that is commonly replaced in Hapi due to libraries going out of date. Therefore, this library attempts to be as minimal as possible in its implementation, so that it can be easily upgraded to newer versions.

There are major limitations due to the simplicity. For one, since we use async/await, it does require Node.js 8. Additionally, @cjhowe7/hapi-auth-jwt doesn't have any extension points, only configuration.

This library can use a secure cookie containing the JWT, but it also supports looking in the Authentication header to better support APIs.

To use this library, first install it via npm with npm i --save @cjhowe7/hapi-auth-jwt or yarn with yarn add @cjhowe7/hapi-auth-jwt. Then, you can include it in your Hapi 17 server like so:

myServer.auth.scheme("jwt", require("@cjhowe7/hapi-auth-jwt"));
myServer.auth.strategy("myStrategy", "jwt", {
  secret: "change-me-i-am-secret"
  // other options...
});

It includes a small API that is accessible via server.auth.api; in the above example, it would be accessed under myServer.auth.api.myStrategy. For example, one thing you might want to do is add a cookie to a request to be verified in the future. This can be done like so (following the example above):

// adds a route to POST a login form with username and password
myServer.route({
  method: "POST",
  path: "/login",
  config: {
    auth: false,
    validate: {
      payload: {
        email: Joi.string()
          .email()
          .required(),
        password: Joi.string().required()
      }
    }
  },
  handler: async ({ payload: { email, password } }, h) => {
    // verify email and password first
    // ...

    // creates a response (you can do this however you want)
    const response = h.response();

    // adds the authentication cookie so future requests are authenticated
    await myServer.auth.api.myStrategy.addCredentials(response, {
      // this credentials object can contain whatever information you want
      // to see later in request.auth.credentials
      email
    });

    // return the response for Hapi to send back
    return response;
  }
});

Scheme Options

These are the options supported by the @cjhowe7/hapi-auth-jwt scheme:

• required secret: The secret used to sign the JWT (see jsonwebtoken)
• sign: Options to pass onto jwt.sign (see jsonwebtoken)
• verify: Options to pass onto jwt.verify (see jsonwebtoken)
• cookie: The name of the cookie stored in request.state
• cookieOption: Additional options to pass to server.state when creating the cookie. If this is false, then the cookie won't be registered at all with server.state. Therefore, you will have to do this through some other means.

License

Copyright 2018 Christian Howe

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.