express-simple-access-control

This is a library for restricting access to applications implemented in express.

Supported Restriction Methods

• Basic Authentication
• IP Filter

Usage

Basic Authentication

An example of Basic Authentication is as follows.

1import express from "express";
2import useAccessControlMiddleware from "express-simple-access-control";
3
4const app = express();
5
6// apply access restrictions
7useAccessControlMiddleware(app, {
8  basicAuthOption: {
9    users: [
10      {username: 'username', password: 'password'},
11    ],
12  },
13});
14
15// ...

IP Filter

An example of IP Filter is as follows.

1import express from "express";
2import useAccessControlMiddleware from "express-simple-access-control";
3
4const app = express();
5
6// apply access restrictions
7useAccessControlMiddleware(app, {
8  ipFilterOption: {
9    allowsIPs: ['XXX.XXX.XXX.XXX'],
10    errStatusCode: 404,
11    errMessage: 'Not Found',
12  },
13});
14
15// ...

Combination of IP Filter and Basic Authentication

An example combination of IP Filter and Basic Authentication is as follows.

1import express from "express";
2import useAccessControlMiddleware from "express-simple-access-control";
3
4const app = express();
5
6// apply access restrictions
7useAccessControlMiddleware(app, {
8  basicAuthOption: {
9    users: [
10      {username: 'username', password: 'password'},
11    ],
12  },
13  ipFilterOption: {
14    allowsIPs: ['XXX.XXX.XXX.XXX'],
15    errStatusCode: 404,
16    errMessage: 'Not Found',
17  },
18});
19
20// ...

In this case, if client IP is allowed, it is considered accessible, and if not allowed, it is shifted to Basic authentication.

1flowchart LR
2p1(IP Filter) -- ok --> s1((Success))
3p1 -- invalid --> p2
4p2(Basic Auth) -- ok --> s1
5p2 -- invalid --> s2((Unauthorized))

Options

Basic Authentication

field name	default	description
users	[]	List of objects with Basic authentication username and password.

IP Filter

field name	default	description
allowIPs	[]	List of accessible IP addresses.
errStatusCode	401	Response status when an access is received from an IP address not included in allowIPs.
errMessage	Unauthorized	Response message when an access is received from an IP address not included in allowIPs.

How to get an IP address

Attempt to obtain an IP address in the following order.

1. x-client-ip in header
2. x-forwarded-for in header
3. cf-connecting-ip in header
4. fastly-client-ip in header
5. true-client-ip in header
6. x-real-ip in header
7. x-cluster-client-ip in header
8. x-forwarded in header
9. forwarded-for in header
10. forwarded in header
11. remoteAddress in socket

License

The scripts and documentation in this repository are released under the MIT License.