Passport.js framework that uses JWT for sessions

This is an alternative framework for Passport.js that is designed to use JWT tokens for sessions. So that, instead of storing user's ID and metadata in a database (e.g. Redis), it encodes that data into a JSON Web Token and writes that token to a session cookie.

How to Install

1$ npm install jwt-passport

Note: It requires Node.js 6.11 or higher

How to Use

1const uuid = require('uuid');
2const express = require('express');
3const passport = require('passport');
4const jwt = require('jwt-passport');
5
6// We're using Knex.js database client in this examle,
7// but it could be any other database driver.
8const db = require('./db');
9
10passport.framework(
11  jwt({
12    name: '__session',
13    secret: '<secret>',
14    audience: '<audience>',
15    issuer: '<issuer>',
16    expiresIn: '1 hour',
17
18    // Prepare payload for an ID token
19    createToken: req => ({
20      sub: req.user.id,
21      jti: uuid.v4(),
22    }),
23
24    // Save user's token in a database
25    saveToken: token =>
26      db
27        .table('user_tokens')
28        .insert({
29          user_id: token.sub,
30          token_id: token.jti,
31        }),
32
33    // Revoke user's token
34    deleteToken: token =>
35      db
36        .table('user_tokens')
37        .where({ token_id: token.jti })
38        .del(),
39
40    // Check if the token was not revoked and find the corresponding user
41    findUser: token =>
42      db
43        .table('user_tokens')
44        .leftJoin('users', 'users.id', 'user_tokens.user_id')
45        .where({ 'user_tokens.token_id': token.jti })
46        .select('users.*')
47        .first(),
48  });
49);
50
51passport.use(new FacebookStrategy(/* config */));
52passport.use(new TwitterStrategy(/* config */));
53
54const app = express();
55
56// Extend the HTTP request object with
57// req.logIn() and req.logOut() helper methods
58app.use(passport.initialize());
59
60// Attemp to parse session cookie, validate the token
61// and put the authenticated user object onto the contxt (req.user)
62app.use(passport.session());
63
64app.get('/', (req, res) => {
65  res.send(`Welcome, ${req.user ? req.user.displayName : 'guest'}!`);
66});
67
68app.get('/login/:provider', (req, res, next) => {
69  passport.authenticate(req.params.provider, /* options */)(req, res, next);
70});
71
72app.get('/login/:provider/return', (req, res, next) => {
73  passport.authenticate(req.params.provider, /* options */)(req, res, next);
74});

Related Articles

• [Stop using JWT for sessions][http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/] (part 2) by @joepie91 + comments on HN
• Where to Store your JWTs – Cookies vs HTML5 Web Storage

Related Projects

• Passport.js — Simple, unobtrusive authentication for Node.js.
• Node.js API Starter — Boilerplate for authoring GraphQL APIs with Node.js and PostgreSQL.
• React Starter Kit — Boilerpalte for authoring isomorphic web apps with React.js and GraphQL.
• React Starter Kit for Firebase — React.js web app boilerplate for serveless architecture.

License

Copyright © 2018-present Kriasoft. This source code is licensed under the MIT license.