#JWT Redis Session for Koa 2

Pure JWT implementation using Redis as session storage for Koa 2, without any cookies

Quick Start

As middleware:

1const koa = require('koa'),
2      bodyParser = require('koa-bodyparser'),
3      session = require('koa-jwt-redis-session')
4// import session from 'koa-jwt-redis-session'
5
6const app = new koa()
7app.use(bodyParser())
8
9app.use(session.default())
10
11// If using import
12// app.use(session()) 
13
14app.use(async function(ctx, next){
15    let views = ctx.session.views || 0
16    ctx.session.views = ++views
17    try{
18       ctx.body = {views: ctx.session.views}
19       await next()
20    }catch(ex){
21       console.error('something wrong:', ex)
22       ctx.status = 500
23       ctx.body = 'something wrong'
24    }
25})
26
27app.listen(3333)

As a function:

1// After used as middleware
2// Somewhere when using as backdore
3import {createSession, authoriseRequest} from 'koa-jwt-redis-session'
4
5let openDoorHandler = async (ctx, next)=>{
6    let userObj = {account: 'sneaky', password: 'open_the_back_door'};
7    let token = await createSession(ctx, userObj);
8    ctx.body = token;
9    // Token is in JSON format: {token: ..... , expiresIn: 3600}
10    // expiresIn is the expire time in seconds, default is 3600
11}
12
13let guardHandler = async (ctx, next)=>{
14    let user = await authoriseRequest(ctx);
15    if( user != undefined){
16        ctx.body = user;
17    }else{
18        ctx.throw(new Error('Unauthorized'));
19    }
20}
21

Options

When creating session instance, you can pass in an option object

1const sessionOptions = {
2       // ......
3}
4app.use(session.default(sessionOptions))
5
6// If using import
7app.use(session(sessionOptions))

Here is the default option values

1{
2  jwt: {
3    contentType: 'application/json',
4    charset: 'utf-8',
5    secret: 'koa-jwt-redis-session' + new Date().getTime(),
6    authPath: '/authorize',
7    registerPath: '/register',
8    refreshTokenPath: '/refreshToken',
9    expiresIn: 3600,
10    accountKey: 'account',
11    passwordKey: 'password',
12    authHandler: function (account, password) {
13            		if (account && password) {
14 				let user = {};
15				user[accountKey] = account;
16				return user;
17			}
18			else return false;
19        },
20    registerHandler: function (account, password) {
21           		if (account && password) {
22				let user = {};
23				user[accountKey] = account;
24				return user;
25			}
26			else return false; 
27        }
28  },
29  session: {
30    sessionKey: 'session',
31    sidKey: 'koa:sess',
32  },
33  redis: {
34    port: 6379,
35    host: '127.0.0.1',
36    db: 0,
37    ttl: 3600,
38    options: {}
39  }
40}

Action flow

1. Anonymous client post JSON user credential information { account: "...", password: "..." } to /register to register an account,
2. or post to /authorize to get authorization
3. Client get token in JSON like { token: "...", expiresIn: 3600 }, or an 401 error if not authorized
4. From then on, client send every request by the http header: Authorization: Bearer <token>,
5. or client would get 401 error if not authorized or token expired
6. On the server side, afterward middlewares can operate ctx.session as will

Enjoy!