xprezzo-basic-auth

Basic auth Authorization header field parser for xprezzo.

Installation

This is a Node.js module available through the npm registry. Installation is done using the npm install command:

$ npm install xprezzo-basic-auth

API

1var auth = require('xprezzo-basic-auth')

auth(req)

Get the basic auth credentials from the given request. The Authorization header is parsed and if the header is invalid, undefined is returned, otherwise an object with name and pass properties.

auth.parse(string)

Parse a basic auth authorization header string. This will return an object with name and pass properties, or undefined if the string is invalid.

Example

Pass a Node.js request object to the module export. If parsing fails undefined is returned, otherwise an object with .name and .pass.

1var auth = require('xprezzo-basic-auth')
2var user = auth(req)
3// => { name: 'something', pass: 'whatever' }

A header string from any other location can also be parsed with auth.parse, for example a Proxy-Authorization header:

1var auth = require('xprezzo-basic-auth')
2var user = auth.parse(req.getHeader('Proxy-Authorization'))

With vanilla node.js http server

1var http = require('http')
2var auth = require('xprezzo-basic-auth')
3var compare = require('tsscmp')
4
5// Create server
6var server = http.createServer(function (req, res) {
7  var credentials = auth(req)
8
9  // Check credentials
10  // The "check" function will typically be against your user store
11  if (!credentials || !check(credentials.name, credentials.pass)) {
12    res.statusCode = 401
13    res.setHeader('WWW-Authenticate', 'Basic realm="example"')
14    res.end('Access denied')
15  } else {
16    res.end('Access granted')
17  }
18})
19
20// Basic function to validate credentials for example
21function check (name, pass) {
22  var valid = true
23
24  // Simple method to prevent short-circut and use timing-safe compare
25  valid = compare(name, 'john') && valid
26  valid = compare(pass, 'secret') && valid
27
28  return valid
29}
30
31// Listen
32server.listen(3000)

People

Xprezzo and related projects are maintained by Cloudgen Wong.

License

MIT