npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

hapi-auth-signed-cookie

v1.0.0

Published

Cookie authentication plugin without encryption

Downloads

3

Readme

hapi-auth-signed-cookie

hapi Cookie authentication plugin

Maintainer: Michal Kawalec

Heavily based on Hapi Auth Cookie by James Weston

Differences

The difference between this and hapi-auth-cookie is that the cookie is accessible on the client side, which enables it to get session data from the cookie. You can decode the data in a cookie like:

const decoded = (new Buffer(session, 'base64')).toString('binary');
const data = JSON.parse(decoded);

Where session is the value of cookie which holds the session.

Docs

Cookie authentication provides a simple cookie-based session management. The user has to be authenticated via other means, typically a web form, and upon successful authentication, receive a reply with a session cookie. Subsequent requests containing the session cookie are authenticated (the cookie uses Iron to encrypt and sign the session content) and validated via the provided validateFunc in case the cookie's encrypted content requires validation on each request. Note that cookie operates as a bearer token and anyone in possession of the cookie content can use it to impersonate its true owner. The 'cookie' scheme takes the following required options:

  • cookie - the cookie name. Defaults to 'sid'.
  • password - used for cookie signing
  • ttl - sets the cookie expires time in milliseconds. Defaults to single browser session (ends when browser closes).
  • domain - sets the cookie Domain value. Defaults to none.
  • path - sets the cookie path value. Defaults to /.
  • clearInvalid - if true, any authentication cookie that fails validation will be marked as expired in the response and cleared. Defaults to false.
  • keepAlive - if true, automatically sets the session cookie after validation to extend the current session for a new ttl duration. Defaults to false.
  • isSecure - if false, the cookie is allowed to be transmitted over insecure connections which exposes it to attacks. Defaults to true.
  • isHttpOnly - if false, the cookie will not include the 'HttpOnly' flag. Defaults to true.
  • redirectTo - optional login URI to redirect unauthenticated requests to. Note that using redirectTo with authentication mode 'try' will cause the protected endpoint to always redirect, voiding 'try' mode. To set an individual route to use or disable redirections, use the route plugins config ({ config: { plugins: { 'hapi-auth-cookie': { redirectTo: false } } } }). Defaults to no redirection.
  • appendNext - if true and redirectTo is true, appends the current request path to the query component of the redirectTo URI using the parameter name 'next'. Set to a string to use a different parameter name. Defaults to false.
  • redirectOnTry - if false and route authentication mode is 'try', authentication errors will not trigger a redirection. Requires hapi version 6.2.0 or newer. Defaults to true;
  • validateFunc - an optional session validation function used to validate the content of the session cookie on each request. Used to verify that the internal session state is still valid (e.g. user account still exists). The function has the signature function(session, callback) where:
    • session - is the session object set via request.auth.session.set().
    • callback - a callback function with the signature function(err, isValid, credentials) where:
      • err - an internal error.
      • isValid - true if the content of the session is valid, otherwise false.
      • credentials - a credentials object passed back to the application in request.auth.credentials. If value is null or undefined, defaults to session. If set, will override the current cookie as if request.auth.session.set() was called.

When the cookie scheme is enabled on a route, the request.auth.session objects is decorated with the following methods:

  • set(session) - sets the current session. Must be called after a successful login to begin the session. session must be a non-null object, which is set on successful subsequent authentications in request.auth.credentials where:
    • session - the session object.
  • set(key, value) - sets a specific object key on the current session (which must already exist) where:
    • key - session key string.
    • value - value to assign key.
  • clear([key]) - clears the current session or session key where:
    • key - optional key string to remove a specific property of the session. If none provided, defaults to removing the entire session which is used to log the user out.
  • ttl(msecs) - sets the ttl of the current active session where:
    • msecs - the new ttl in milliseconds.

Because this scheme decorates the request object with session-specific methods, it cannot be registered more than once.

var Hapi = require('hapi');

var users = {
    john: {
        id: 'john',
        password: 'password',
        name: 'John Doe'
    }
};

var home = function (request, reply) {

    reply('<html><head><title>Login page</title></head><body><h3>Welcome '
      + request.auth.credentials.name
      + '!</h3><br/><form method="get" action="/logout">'
      + '<input type="submit" value="Logout">'
      + '</form></body></html>');
};

var login = function (request, reply) {

    if (request.auth.isAuthenticated) {
        return reply.redirect('/');
    }

    var message = '';
    var account = null;

    if (request.method === 'post') {

        if (!request.payload.username ||
            !request.payload.password) {

            message = 'Missing username or password';
        }
        else {
            account = users[request.payload.username];
            if (!account ||
                account.password !== request.payload.password) {

                message = 'Invalid username or password';
            }
        }
    }

    if (request.method === 'get' ||
        message) {

        return reply('<html><head><title>Login page</title></head><body>'
            + (message ? '<h3>' + message + '</h3><br/>' : '')
            + '<form method="post" action="/login">'
            + 'Username: <input type="text" name="username"><br>'
            + 'Password: <input type="password" name="password"><br/>'
            + '<input type="submit" value="Login"></form></body></html>');
    }

    request.auth.session.set(account);
    return reply.redirect('/');
};

var logout = function (request, reply) {

    request.auth.session.clear();
    return reply.redirect('/');
};

var server = new Hapi.Server();
server.connection({ port: 8000 });

server.register(require('hapi-auth-cookie'), function (err) {

    server.auth.strategy('session', 'cookie', {
        password: 'secret',
        cookie: 'sid-example',
        redirectTo: '/login',
        isSecure: false
    });
});

server.route([
    {
        method: 'GET',
        path: '/',
        config: {
            handler: home,
            auth: 'session'
        }
    },
    {
        method: ['GET', 'POST'],
        path: '/login',
        config: {
            handler: login,
            auth: {
                mode: 'try',
                strategy: 'session'
            },
            plugins: {
                'hapi-auth-cookie': {
                    redirectTo: false
                }
            }
        }
    },
    {
        method: 'GET',
        path: '/logout',
        config: {
            handler: logout,
            auth: 'session'
        }
    }
]);

server.start();