{"id":28076736,"url":"https://github.com/jaredhanson/passport-http-oauth","last_synced_at":"2025-05-13T01:49:04.935Z","repository":{"id":3522038,"uuid":"4580869","full_name":"jaredhanson/passport-http-oauth","owner":"jaredhanson","description":"HTTP OAuth authentication strategy for Passport and Node.js.","archived":false,"fork":false,"pushed_at":"2022-10-25T00:10:29.000Z","size":102,"stargazers_count":72,"open_issues_count":11,"forks_count":25,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-05-13T01:48:52.628Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://www.passportjs.org/packages/passport-http-oauth/?utm_source=github\u0026utm_medium=referral\u0026utm_campaign=passport-http-oauth\u0026utm_content=about","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jaredhanson.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null},"funding":{"patreon":"jaredhanson","ko_fi":"jaredhanson"}},"created_at":"2012-06-07T03:37:14.000Z","updated_at":"2024-06-01T20:46:13.000Z","dependencies_parsed_at":"2022-08-26T01:10:38.937Z","dependency_job_id":null,"html_url":"https://github.com/jaredhanson/passport-http-oauth","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jaredhanson%2Fpassport-http-oauth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jaredhanson%2Fpassport-http-oauth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jaredhanson%2Fpassport-http-oauth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jaredhanson%2Fpassport-http-oauth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jaredhanson","download_url":"https://codeload.github.com/jaredhanson/passport-http-oauth/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253856615,"owners_count":21974576,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-05-13T01:49:04.330Z","updated_at":"2025-05-13T01:49:04.927Z","avatar_url":"https://github.com/jaredhanson.png","language":"JavaScript","funding_links":["https://patreon.com/jaredhanson","https://ko-fi.com/jaredhanson"],"categories":[],"sub_categories":[],"readme":"# Passport-HTTP-OAuth\n\nHTTP OAuth authentication strategy for [Passport](https://github.com/jaredhanson/passport).\n\nThis module lets you authenticate HTTP requests using the authorization scheme\ndefined by the [OAuth](http://tools.ietf.org/html/rfc5849) 1.0 protocol.  OAuth\nis typically used protect API endpoints, including endpoints defined by the\nOAuth protocol itself, as well as other endpoints exposed by the server.\n\nBy plugging into Passport, OAuth API authentication can be easily and\nunobtrusively integrated into any application or framework that supports [Connect](http://www.senchalabs.org/connect/)-style\nmiddleware, including [Express](http://expressjs.com/).\n\nNote that this strategy provides support for implementing OAuth as a service\nprovider.  If your application is implementing OAuth as a client for delegated\nauthentication (for example, using [Facebook](https://github.com/jaredhanson/passport-facebook)\nor [Twitter](https://github.com/jaredhanson/passport-twitter)), please see\n[Passport-OAuth](https://github.com/jaredhanson/passport-oauth) for the\nappropriate strategy.\n\n\u003cdiv align=\"center\"\u003e\n\n:heart: [Sponsors](https://www.passportjs.org/sponsors/?utm_source=github\u0026utm_medium=referral\u0026utm_campaign=passport-http-oauth\u0026utm_content=nav-sponsors)\n\n\u003c/div\u003e\n\n[![npm](https://img.shields.io/npm/v/passport-http-oauth.svg)](https://www.npmjs.com/package/passport-http-oauth)\n[![build](https://img.shields.io/travis/jaredhanson/passport-http-oauth.svg)](https://travis-ci.org/jaredhanson/passport-http-oauth)\n[![coverage](https://img.shields.io/coveralls/jaredhanson/passport-http-oauth.svg)](https://coveralls.io/github/jaredhanson/passport-http-oauth)\n[...](https://github.com/jaredhanson/passport-http-oauth/wiki/Status)\n\n## Install\n\n    $ npm install passport-http-oauth\n\n## Usage of Consumer Strategy\n\n#### Configure Strategy\n\nThe OAuth consumer authentication strategy authenticates consumers based on a\nconsumer key and secret (and optionally a temporary request token and secret).\nThe strategy requires a `consumer` callback, `token` callback, and `validate`\ncallback.  The secrets supplied by the `consumer` and `token` callbacks are used\nto compute a signature, and authentication fails if it does not match the\nrequest signature.  `consumer` as supplied by the `consumer` callback is the\nauthenticating entity of this strategy, and will be set by Passport at\n`req.user`.\n\n    passport.use('consumer', new ConsumerStrategy(\n      function(consumerKey, done) {\n        Consumer.findByKey({ key: consumerKey }, function (err, consumer) {\n          if (err) { return done(err); }\n          if (!consumer) { return done(null, false); }\n          return done(null, consumer, consumer.secret);\n        });\n      },\n      function(requestToken, done) {\n        RequestToken.findOne(requestToken, function (err, token) {\n          if (err) { return done(err); }\n          if (!token) { return done(null, false); }\n          // third argument is optional info.  typically used to pass\n          // details needed to authorize the request (ex: `verifier`)\n          return done(null, token.secret, { verifier: token.verifier });\n        });\n      },\n      function(timestamp, nonce, done) {\n        // validate the timestamp and nonce as necessary\n        done(null, true)\n      }\n    ));\n\n#### Authenticate Requests\n\nUse `passport.authenticate()`, specifying the `'consumer'` strategy, to\nauthenticate requests.  This strategy is intended for use in the request token\nand access token API endpoints, so the `session` option can be set to `false`.\n\nFor example, as route middleware in an [Express](http://expressjs.com/)\napplication:\n\n    app.post('/access_token', \n      passport.authenticate('consumer', { session: false }),\n      oauthorize.accessToken(\n        // ...\n      });\n\n## Usage of Token Strategy\n\n#### Configure Strategy\n\nThe OAuth token authentication strategy authenticates users based on an\naccess token issued to a consumer.  The strategy requires a `consumer` callback,\n`verify` callback, and `validate` callback.  The secrets supplied by the\n`consumer` and `verify` callbacks are used to compute a signature, and\nauthentication fails if it does not match the request signature.  `user` as\nsupplied by the `verify` callback is the authenticating entity of this strategy,\nand will be set by Passport at `req.user`.\n\n    passport.use('token', new TokenStrategy(\n      function(consumerKey, done) {\n        Consumer.findByKey({ key: consumerKey }, function (err, consumer) {\n          if (err) { return done(err); }\n          if (!consumer) { return done(null, false); }\n          return done(null, consumer, consumer.secret);\n        });\n      },\n      function(accessToken, done) {\n        AccessToken.findOne(accessToken, function (err, token) {\n          if (err) { return done(err); }\n          if (!token) { return done(null, false); }\n          Users.findOne(token.userId, function(err, user) {\n            if (err) { return done(err); }\n            if (!user) { return done(null, false); }\n            // fourth argument is optional info.  typically used to pass\n            // details needed to authorize the request (ex: `scope`)\n            return done(null, user, token.secret, { scope: token.scope });\n          });\n        });\n      },\n      function(timestamp, nonce, done) {\n        // validate the timestamp and nonce as necessary\n        done(null, true)\n      }\n    ));\n    \n#### Authenticate Requests\n\nUse `passport.authenticate()`, specifying the `'token'` strategy, to\nauthenticate requests.  This strategy is intended for use in protected API\nendpoints, so the `session` option can be set to `false`.\n\nFor example, as route middleware in an [Express](http://expressjs.com/)\napplication:\n\n    app.get('/api/userinfo', \n      passport.authenticate('token', { session: false }),\n      function(req, res) {\n        res.json(req.user);\n      });\n\n## Issuing Tokens\n\n[OAuthorize](https://github.com/jaredhanson/oauthorize) is a toolkit for\nimplementing OAuth service providers.  It bundles a suite of middleware\nimplementing the request token, access token, and user authorization endpoints\nof the OAuth 1.0 protocol.\n\nThe toolkit, combined with the `ConsumerStrategy` and a user authentication\nstrategy can be used to implement the complete OAuth flow, issuing access tokens\nto consumers.  `TokenStrategy` can then be used to protect API endpoints using\nthe access tokens issued.\n\n## Examples\n\nThe [example](https://github.com/jaredhanson/oauthorize/tree/master/examples/express2)\nincluded with [OAuthorize](https://github.com/jaredhanson/oauthorize)\ndemonstrates how to implement a complete OAuth service provider.\n`ConsumerStrategy` is used to authenticate clients as they request tokens from\nthe request token and access token endpoints.  `TokenStrategy` is used to\nauthenticate users and clients making requests to API endpoints.\n\n## Tests\n\n    $ npm install --dev\n    $ make test\n\n[![Build Status](https://secure.travis-ci.org/jaredhanson/passport-http-oauth.png)](http://travis-ci.org/jaredhanson/passport-http-oauth)\n\n## Credits\n\n  - [Jared Hanson](http://github.com/jaredhanson)\n\n## License\n\n[The MIT License](http://opensource.org/licenses/MIT)\n\nCopyright (c) 2012-2013 Jared Hanson \u003c[http://jaredhanson.net/](http://jaredhanson.net/)\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjaredhanson%2Fpassport-http-oauth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjaredhanson%2Fpassport-http-oauth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjaredhanson%2Fpassport-http-oauth/lists"}