{"id":13403063,"url":"https://github.com/mikenicholson/passport-jwt","last_synced_at":"2025-04-25T14:47:51.320Z","repository":{"id":23020045,"uuid":"26371373","full_name":"mikenicholson/passport-jwt","owner":"mikenicholson","description":"Passport authentication using JSON Web Tokens","archived":false,"fork":false,"pushed_at":"2024-02-03T20:10:41.000Z","size":490,"stargazers_count":1978,"open_issues_count":42,"forks_count":212,"subscribers_count":19,"default_branch":"master","last_synced_at":"2025-04-18T13:09:51.415Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mikenicholson.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2014-11-08T19:05:44.000Z","updated_at":"2025-04-11T11:36:51.000Z","dependencies_parsed_at":"2024-06-18T11:01:49.644Z","dependency_job_id":"d302457d-5583-4e5e-a667-da6de043bc8d","html_url":"https://github.com/mikenicholson/passport-jwt","commit_stats":{"total_commits":128,"total_committers":31,"mean_commits":4.129032258064516,"dds":0.3046875,"last_synced_commit":"fed94fa005c5b2dcb7e6d5d5372e3b20cae898f1"},"previous_names":["themikenicholson/passport-jwt"],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mikenicholson%2Fpassport-jwt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mikenicholson%2Fpassport-jwt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mikenicholson%2Fpassport-jwt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mikenicholson%2Fpassport-jwt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mikenicholson","download_url":"https://codeload.github.com/mikenicholson/passport-jwt/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250496986,"owners_count":21440231,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-30T19:01:24.914Z","updated_at":"2025-04-24T04:22:03.427Z","avatar_url":"https://github.com/mikenicholson.png","language":"JavaScript","funding_links":[],"categories":["JavaScript","Implementations(Examples/Demos)"],"sub_categories":["Invalidating JWT"],"readme":"# passport-jwt\n\n[![Build Status](https://travis-ci.org/mikenicholson/passport-jwt.svg?branch=master)](https://travis-ci.org/mikenicholson/passport-jwt)\n[![Code Climate](https://codeclimate.com/github/mikenicholson/passport-jwt/badges/gpa.svg)](https://codeclimate.com/github/mikenicholson/passport-jwt)\n\nA [Passport](http://passportjs.org/) strategy for authenticating with a\n[JSON Web Token](http://jwt.io).\n\nThis module lets you authenticate endpoints using a JSON web token. It is\nintended to be used to secure RESTful endpoints without sessions.\n\n## Supported By\n\nIf you want to quickly add secure token-based authentication to Node.js apps, feel free to check out Auth0's Node.js SDK and free plan at [auth0.com/developers](https://auth0.com/developers?utm_source=GHsponsor\u0026utm_medium=GHsponsor\u0026utm_campaign=passport-jwt\u0026utm_content=auth) \u003cimg alt='Auth0 Logo' src='https://s3.amazonaws.com/passport-jwt-img/Auth0+logo.svg'/\u003e\n\n## Install\n\n    npm install passport-jwt\n\n## Usage\n\n### Configure Strategy\n\nThe JWT authentication strategy is constructed as follows:\n\n    new JwtStrategy(options, verify)\n\n`options` is an object literal containing options to control how the token is\nextracted from the request or verified.\n\n* `secretOrKey` is a string or buffer containing the secret\n  (symmetric) or PEM-encoded public key (asymmetric) for verifying the token's\n  signature. REQUIRED unless `secretOrKeyProvider` is provided.\n* `secretOrKeyProvider` is a callback in the format `function secretOrKeyProvider(request, rawJwtToken, done)`,\n  which should call `done` with a secret or PEM-encoded public key (asymmetric) for the given key and request combination.\n  `done` accepts arguments in the format `function done(err, secret)`. Note it is up to the implementer to decode rawJwtToken.\n  REQUIRED unless `secretOrKey` is provided.\n* `jwtFromRequest` (REQUIRED) Function that accepts a request as the only\n  parameter and returns either the JWT as a string or *null*. See\n  [Extracting the JWT from the request](#extracting-the-jwt-from-the-request) for\n  more details.\n* `issuer`: If defined the token issuer (iss) will be verified against this\n  value.\n* `audience`: If defined, the token audience (aud) will be verified against\n  this value.\n* `algorithms`: List of strings with the names of the allowed algorithms. For instance, [\"HS256\", \"HS384\"].\n* `ignoreExpiration`: if true do not validate the expiration of the token.\n* `passReqToCallback`: If true the request will be passed to the verify\n  callback. i.e. verify(request, jwt_payload, done_callback).\n* `jsonWebTokenOptions`: passport-jwt is verifying the token using [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken).\nPass here an options object for any other option you can pass the jsonwebtoken verifier. (i.e maxAge)\n\n`verify` is a function with the parameters `verify(jwt_payload, done)`\n\n* `jwt_payload` is an object literal containing the decoded JWT payload.\n* `done` is a passport error first callback accepting arguments\n  done(error, user, info)\n\nAn example configuration which reads the JWT from the http\nAuthorization header with the scheme 'bearer':\n\n```js\nvar JwtStrategy = require('passport-jwt').Strategy,\n    ExtractJwt = require('passport-jwt').ExtractJwt;\nvar opts = {}\nopts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();\nopts.secretOrKey = 'secret';\nopts.issuer = 'accounts.examplesoft.com';\nopts.audience = 'yoursite.net';\npassport.use(new JwtStrategy(opts, function(jwt_payload, done) {\n    User.findOne({id: jwt_payload.sub}, function(err, user) {\n        if (err) {\n            return done(err, false);\n        }\n        if (user) {\n            return done(null, user);\n        } else {\n            return done(null, false);\n            // or you could create a new account\n        }\n    });\n}));\n```\n\n### Extracting the JWT from the request\n\nThere are a number of ways the JWT may be included in a request.  In order to remain as flexible as\npossible the JWT is parsed from the request by a user-supplied callback passed in as the\n`jwtFromRequest` parameter.  This callback, from now on referred to as an extractor,\naccepts a request object as an argument and returns the encoded JWT string or *null*.\n\n#### Included extractors\n\nA number of extractor factory functions are provided in passport-jwt.ExtractJwt. These factory\nfunctions return a new extractor configured with the given parameters.\n\n* ```fromHeader(header_name)``` creates a new extractor that looks for the JWT in the given http\n  header\n* ```fromBodyField(field_name)``` creates a new extractor that looks for the JWT in the given body\n  field.  You must have a body parser configured in order to use this method.\n* ```fromUrlQueryParameter(param_name)``` creates a new extractor that looks for the JWT in the given\n  URL query parameter.\n* ```fromAuthHeaderWithScheme(auth_scheme)``` creates a new extractor that looks for the JWT in the\n  authorization header, expecting the scheme to match auth_scheme.\n* ```fromAuthHeaderAsBearerToken()``` creates a new extractor that looks for the JWT in the authorization header\n  with the scheme 'bearer'\n* ```fromExtractors([array of extractor functions])``` creates a new extractor using an array of\n  extractors provided. Each extractor is attempted in order until one returns a token.\n\n### Writing a custom extractor function\n\nIf the supplied extractors don't meet your needs you can easily provide your own callback. For\nexample, if you are using the cookie-parser middleware and want to extract the JWT in a cookie\nyou could use the following function as the argument to the jwtFromRequest option:\n\n```js\nvar cookieExtractor = function(req) {\n    var token = null;\n    if (req \u0026\u0026 req.cookies) {\n        token = req.cookies['jwt'];\n    }\n    return token;\n};\n// ...\nopts.jwtFromRequest = cookieExtractor;\n```\n\n### Authenticate requests\n\nUse `passport.authenticate()` specifying `'JWT'` as the strategy.\n\n```js\napp.post('/profile', passport.authenticate('jwt', { session: false }),\n    function(req, res) {\n        res.send(req.user.profile);\n    }\n);\n```\n\n### Include the JWT in requests\n\nThe method of including a JWT in a request depends entirely on the extractor\nfunction you choose. For example, if you use the `fromAuthHeaderAsBearerToken`\nextractor, you would include an `Authorization` header in your request with the\nscheme set to `bearer`. e.g.\n\n    Authorization: bearer JSON_WEB_TOKEN_STRING.....\n\n## Migrating\n\nRead the [Migration Guide](docs/migrating.md) for help upgrading to the latest\nmajor version of passport-jwt.\n\n## Tests\n\n    npm install\n    npm test\n\nTo generate test-coverage reports:\n\n    npm install -g istanbul\n    npm run-script testcov\n    istanbul report\n\n## License\n\nThe [MIT License](http://opensource.org/licenses/MIT)\n\nCopyright (c) 2015 Mike Nicholson\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmikenicholson%2Fpassport-jwt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmikenicholson%2Fpassport-jwt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmikenicholson%2Fpassport-jwt/lists"}