sequelize-authentication
A connect module for authentication against a database.
Build status
The automated tests we talk about just so much are running on Travis public CI, here is its status:
Usage
var app = express()
, authentication = require('sequelize-authentication')
, Sequelize = require('sequelize')
, sequelize = new Sequelize('database', 'user', 'password')
app.configure(function() {
// express.static would go here
app.use(authentication(sequelize[, options]))
// express router would go here
})
Note: If you are serving static files (e.g. via express.static
), make sure, that authentication is added afterwards.
Also you should make sure, that the router is added after the authentication module.
Options
The second parameter of the authentication
function is an object with options. Let's assume an application,
that delivers hello world
if the a user has authenticated successfully for the following description. You
might want to check the example application under example/app.js
. My local database has a root
user
without password.
via
Option: via
defines, where the module will find the credentials.
Credentials in the params (default)
authentication(sequelize, { via: 'params' })
This will tell the module, that the credentials are either in the URL of the request or the body (POST). If you don't want to use headers, this is most likely what you want.
curl "http://localhost:3000?user=root&password="
# => hello world
curl "http://localhost:3000?user=root&password=fnord"
# => Unauthorized
curl -d "user=root&password=" "http://localhost:3000"
# => hello world
curl -d "user=root&password=fnord" "http://localhost:3000"
# => Unauthorized
Credentials in the headers
authentication(sequelize, { via: 'headers' })
This defines, that the credentials are in the headers of the request.
curl "http://localhost:3000?user=root&password="
# => Unauthorized
curl "http://localhost:3000?user=root&password=fnord"
# => Unauthorized
curl -d "user=root&password=" "http://localhost:3000"
# => Unauthorized
curl -d "user=root&password=fnord" "http://localhost:3000"
# => Unauthorized
curl -H "user: root" -H "password: " http://localhost:3000
# => hello world
curl -H "user: root" -H "password: fnord" http://localhost:3000
# => Unauthorized
Credentials in the URL
authentication(sequelize, { via: 'query' })
Credentials are in the URL of the request only.
curl "http://localhost:3000?user=root&password="
# => hello world
curl "http://localhost:3000?user=root&password=fnord"
# => Unauthorized
curl -d "user=root&password=" "http://localhost:3000"
# => Unauthorized
curl -d "user=root&password=fnord" "http://localhost:3000"
# => Unauthorized
Credentials in the post body
authentication(sequelize, { via: 'body' })
Credentials are in the body of the request only.
curl "http://localhost:3000?user=root&password="
# => Unauthorized
curl "http://localhost:3000?user=root&password=fnord"
# => Unauthorized
curl -d "user=root&password=" "http://localhost:3000"
# => hello world
curl -d "user=root&password=fnord" "http://localhost:3000"
# => Unauthorized
scope
Option: scope
defines, which urls should receive protection via the module.
authentication(sequelize, { scope: '/api' })
This will protect each url that starts with /api
.
curl http://localhost:3000
# => hello world
curl http://localhost:3000/api/secret
# => Unauthorized
curl http://localhost:3000/api/secret?user=root&password=
# => hello world
param
Option: param
defines a parameter name which scopes the credentials. The default is none.
authentication(sequelize, { param: 'credentials' })
The module will now check, if the credentials are located in the credentials object.
curl "http://localhost:3000?credentials\[user\]=root&credentials\[password\]="
# => hello world
Hm? So, what's next?
The server will send each request through the authentication module. If the request authenticates correctly, it will be passed to the router. If authentication fails, the module will response with a 401 and the message 'Unauthorized'.
License
Hereby placed under MIT license.