Server

Implement store and validation functions:

// Optional
const storeJWTSecretHandler = async (jwtSecret) => {
  await db.put('sessionEncryptSecret', jwtSecret);
};

const validateRequestHandler = async ({username, password}) => {
  const userAndPasswordValid = /* Boolean */;

  return userAndPasswordValid;
};

const storeSessionKeyHandler = async (sessionKey, {username}) => {
  const users = await db.get('users');

  users[username].sessionKey = sessionKey;

  return await db.put('users', users).then(() => sessionKey).catch(() => null);
};

const validateSessionKeyInStoreHandler = async (sessionKey, {username}) => {
  const users = await db.get('users');

  return (users[username] || {}).sessionKey === sessionKey;
};

Instantiate Server Session Manager:

const sessionManager = new ServerJWTSessionManager({
  jwtSecret: await db.get('sessionSecret', {asBuffer: false}).catch((e) => null),
  storeJWTSecretHandler,
  validateRequestHandler,
  storeSessionKeyHandler,
  validateSessionKeyInStoreHandler,
});

// If you implement storeJWTSecretHandler you can wait for
// the JWT secret to be stored using jwtSecretStorePromise
await sessionManager.jwtSecretStorePromise.then(() => console.log(sessionManager.jwtSecret));

Use the Server Session Manager instance to validate:

app.get('/request-token', (request, response) => {
  response.end(sessionManager.generateSessionRequestToken());
});

app.post('/login', (request, response) => {
  const {
    requestToken,
    username,
    password,
  } = request.body;

  const sessionToken = await sessionManager.processSessionRequest(requestToken, {
    username,
    password,
  });

  if (!sessionToken) {
    return handleNotAuthorized(request, response);
  }

  response.end(sessionToken);
});

app.get('/logout', async (request, response) => {
  const sessionToken = request.headers['authorization'].replace(/^Bearer\s/, '');
  const username = request.headers['user'];

  const valid = await sessionManager.checkSessionToken(sessionToken, {username});

  if (!valid) {
    return handleNotAuthorized(request, response);
  }

  const users = await db.get('users');

  const {
    sessionKey,
    ...loggetOutUserData
  } = users[username];

  users[username] = loggetOutUserData;

  await db.put('users', users);

  response.end('ok');
});

app.get('/user', async (request, response) => {
  const sessionToken = request.headers['authorization'].replace(/^Bearer\s/, '');
  const username = request.headers['user'];

  const valid = await sessionManager.checkSessionToken(sessionToken, {username});

  if (!valid) {
    return handleNotAuthorized(request, response);
  }

  const users = await db.get('users', {asBuffer: false});

  const {
    sessionKey,
    password,
    ...safeUserData
  } = users[username];

  response.end(JSON.stringify(safeUserData));
});

Client

Implement get functions (required):

// This example is for browser with bluebird and jquery
// for other versions in "examples" directory

var getSessionRequestTokenHandler = function() {
  return new Promise(function(resolve, reject) {
    $.get('request-token', function(data) {
      resolve(data);
    });
  })
};

var getSessionHandler = function(sessionRequestToken) {
  return new Promise(function(resolve, reject) {
    var loginOptions = {
      requestToken: sessionRequestToken,
      username: $('.username')[0].value,
      password: $('.password')[0].value,
    };

    $.post('login', loginOptions, function(data) {
      resolve(data);
    }).fail(function() {
      reject(null);
    });
  });
};

Optionally implement store and/or close functions:

var storeSessionRequestTokenHandler = function(sessionRequestToken) {
  return new Promise(function(resolve, reject) {
    try {
      window.localStorage.setItem('requestToken', sessionRequestToken);

      resolve();
    } catch (e) {
      reject(e);
    }
  });
};

var storeSessionTokenHandler = function(sessionToken) {
  return new Promise(function(resolve, reject) {
    try {
      window.localStorage.setItem('sessionToken', sessionToken);
      window.localStorage.setItem('username', $('.username')[0].value);
      window.localStorage.removeItem('requestToken');

      resolve();
    } catch (e) {
      reject(e);
    }
  });
};

var closeSessionHandler = function(sessionToken) {
  return new Promise(function(resolve, reject) {
    try {
      window.localStorage.removeItem('sessionToken');

      resolve();
    } catch (e) {
      reject(e);
    }
  });
};

Instantiate Client Session Manager:

var sessionManager = new ClientJWTSessionManager({
  getSessionRequestTokenHandler,
  storeSessionRequestTokenHandler,
  getSessionHandler,
  storeSessionTokenHandler,
  closeSessionHandler,
}, {
  // Optional to keep session alive, in this example only works if you implemented
  // storeSessionRequestTokenHandler and storeSessionTokenHandler
  sessionRequestToken: window.localStorage.getItem('requestToken'),
  sessionToken: window.localStorage.getItem('sessionToken'),
});

Use the Client Session Manager instance to request data safely:

var initializeLoginForm = function() {
  $('.login-button').click(function(e) {
    e.preventDefault();

    sessionManager.getSession().then(function() {
      // You are logged in, you can redirect or do something here
    }).catch(function() {
      sessionManager.getSessionRequestToken().then(function() {
        alert('You took too long to log in, reload the page and try again.');
      }).catch(function() {
        alert('Unable to get request token from server.');
      })
    });
  });
};

sessionManager.getSessionRequestToken().then(initializeLoginForm);

Tests

Tests implemented using jest

yarn test

Lint

Linting uses tslint

yarn lint

Build

Build uses rollup to build Node module and Browser compatible dist files

yarn build

note: if you change version be sure to run tests before build so version file gets updated

More examples

In the examples directory

TODO

Better documentation

Contribute

Contributions welcome and encouraged

License

Apache 2.0