authmagic-timerange-stateless-core

Stateless and passwordless authentication core for authmagic.

Magic link

To check the identity of the user it is possible to send an authorization link to his email, phone or any other resource. By clicking on that link user identifies himself as an owner of the resource. You can see many apps who suggest this option, for example medium.com and auth0.com.

How it looks in the real world:

Passwordless

Magic link allows not to have any connection to users list. By that you have an option to build completely isolated authentication service.

Stateless

Current core is sharing JWT tokens by request what allows not to keep any state data.

Middlewares

1. express.js

API

Core expects json format of data.

post /key

Generate ekey and send it to the resource owned by client, like email.

Input:

user - object with user description, it will be added to the JWT as an opened information

redirectUrl - string of redirect destination after key generated

params - object with user description, it will be added to the JWT as an opened information

Output:

eproof - encrypted version of ekey which could be used to get the token if ekey was activated

post /token

Generate JWT token from key. Token could be generated in 3 different scenarios: from ekay, from eproof, from token + refreshToken

Input:

ekey - code sent to resource own by client, like email

eproof - encrypted version of ekey which could be used to get the token if ekey was activated

token - valid token

refreshToken - valid refresh token

Output:

token - valid updated token

get /token/status/:token

Checks the status of the token provided.

Main idea

Next few lines of code show main objects used in the core.

const ekey = generateEkeyFromUserAndDuration(user, duration);
const token = getToken({u: user, p: params}, key, {expiresIn});
const eproof = encrypt(ekey, key);

Configuration

Core could be configured using next params, they are reflected in the configuration file:

duration - in seconds, duration of the ekey's validity

key - secret key which will be used for encryption, it ensures a security of whole solution

sendKeyPlugin - name of the plugin which will be used to send ekey

expiresIn - in seconds, duration of the token's validity

Plugins

In this core plugin is used to send a message with ekey.

sendKeyPlugin({user, redirectUrl, params, ekey, config});

So plugin is a function with arguments you see above. See existining plugins for real examples: authmagic-email-plugin, authmagic-proxy-plugin, authmagic-smsc-plugin.

Licence

authmagic-timerange-stateless-core is MIT licensed.