https://github.com/futurestudio/hapi-auth-multiple-strategies
A hapi plugin to require multiple authentication strategies
https://github.com/futurestudio/hapi-auth-multiple-strategies
auth authentication future-studio-university hapi hapi-auth hapi-plugin hapijs multiple-strategies
Last synced: 10 months ago
JSON representation
A hapi plugin to require multiple authentication strategies
- Host: GitHub
- URL: https://github.com/futurestudio/hapi-auth-multiple-strategies
- Owner: futurestudio
- License: mit
- Created: 2019-01-08T13:30:29.000Z (about 7 years ago)
- Default Branch: master
- Last Pushed: 2024-01-25T12:42:48.000Z (about 2 years ago)
- Last Synced: 2025-04-12T19:08:41.247Z (10 months ago)
- Topics: auth, authentication, future-studio-university, hapi, hapi-auth, hapi-plugin, hapijs, multiple-strategies
- Language: JavaScript
- Homepage:
- Size: 233 KB
- Stars: 7
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project
README
Require multiple authentication strategies in hapi.
Installation ·
Usage ·
Strategy Options
Follow @marcuspoehls for updates!
------
The Future Studio University supports development of this hapi plugin 🚀
Join the Future Studio University and Skyrocket in Node.js
------
## Introduction
Add `hapi-auth-multiple-strategies` in your hapi project to authenticate a request against multiple authentication strategies. Hapi allows you to define multiple auth strategies on a route, but this requires only a single strategy to authenticate the request. In contrast, `hapi-auth-multiple-strategies` requires all strategies to be successful.
## Installation
Add `hapi-auth-multiple-strategies` as a dependency to your project:
```bash
npm i hapi-auth-multiple-strategies
```
## Requirements
> **hapi v19 (or later)** and **Node.js v12 (or newer)**
This plugin requires **hapi v19** (or later) and **Node.js v12 or newer**.
### Compatibility
| Major Release | [hapi.js](https://github.com/hapijs/hapi) version | Node.js version |
| --- | --- | --- |
| `v3` | `>=18 hapi` | `>=12` |
| `v2` | `>=18 hapi` | `>=8` |
| `v1` | `>=17 hapi` | `>=8` |
## Usage
Register `hapi-auth-multiple-strategies` to your hapi server. This will add the `multiple-strategies` authentication scheme to your hapi server.
```js
await server.register({
plugin: require('hapi-auth-multiple-strategies')
})
// went smooth like chocolate :)
// now your hapi server supports the 'multiple-strategies' auth scheme
```
Then declare a new authentication strategy base on the `multiple-strategies` scheme and pass in all required `strategies`.
```js
// Assuming you have the following strategies your server
server.auth.strategy('jwt', 'bearer', options);
server.auth.strategy('jwt-refresh', 'token', options);
// create a new strategy that requires both 'jwt' strategies
server.auth.strategy('jwt-all-in', 'multiple-strategies', {
strategies: ['jwt', 'jwt-refresh']
});
// use the 'jwt-all-in' strategy on your route
server.route({
method: 'GET',
path: '/api/logout',
config: {
auth: 'jwt-all-in',
handler: () => 'hey bud, you’re logged out'
}
});
```
The `jwt-all-in` strategy ensures that an incoming request satisfies both strategies, `jwt` and `jwt-refresh`.
If a request doesn’t authenticate with one or more of the strategies, it will return unauthenticated.
## Authentication Strategy Options
When creating a new authentication strategy using the `multiple-strategies` scheme, you’re required to pass in an array of the authentication strategy names that are required.
- **`strategies`**: (Array), required
- an array of auth strategy names against a request will be authenticated
## Credentials & Scope
Typically the `request.auth.credentials` is populated with the credentials from a single strategy. When testing multiple strategies, you’ll get the credentials from all strategies.
When a request passes all authentication strategies, the related credentials are assigned to the strategy’s name in `request.auth.credentials`.
Because hapi authorizes requests via the `scope` property, you’ll find the aggregated scope from all strategies in the credentials as well.
Here’s a sample result of `request.auth.credentials`:
```js
{
jwt: { name: 'Marcus', scope: [ 'admin' ] }
'jwt-refresh': { username: 'marcus', name: 'Marcus', scope: [ 'user' ] }
scope: [ 'admin', 'user' ]
});
```
Enjoy!
## Links & Resources
- [hapi tutorial series](https://futurestud.io/tutorials/hapi-get-your-server-up-and-running) with 100+ tutorials
## Contributing
1. Create a fork
2. Create your feature branch: `git checkout -b my-feature`
3. Commit your changes: `git commit -am 'Add some feature'`
4. Push to the branch: `git push origin my-new-feature`
5. Submit a pull request 🚀
## License
MIT © [Future Studio](https://futurestud.io)
---
> [futurestud.io](https://futurestud.io) ·
> GitHub [@futurestudio](https://github.com/futurestudio/) ·
> Twitter [@futurestud_io](https://twitter.com/futurestud_io)