Skip to content

Commit d5af311

Browse files
mikenicholsonmikenicholson
committed
Get rid of JWT as the default auth scheme.
Per #87 'jwt' was not a great choice of default value for the authorization scheme since RFC6750 explicitly states that 'bearer' is the proper scheme, at least in the context of OAuth 2.0. Since this change breaks backwards compatibility I tried to be very explicit. extractors.fromAuthHeader() was removed and replaced with the more explicit 'extractors.fromAuthHeaderAsBearerToken()'. Anyone wanting to maintain passport-jwt 2.* behavior may use the follinwg extractor instead of fromAuthHeader(): extractors.fromAuthHeaderWithScheme('jwt') The legacy (v 1.*) extractor, extractors.versionOneCompatibilit() still iuses 'JWT' as the default auth scheme. Fixes #87
1 parent 80e049c commit d5af311

File tree

5 files changed

+30
-29
lines changed

5 files changed

+30
-29
lines changed

‎README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -52,13 +52,13 @@ Pass here an options object for any other option you can pass the jsonwebtoken v
5252
done(error, user, info)
5353

5454
An example configuration which reads the JWT from the http
55-
Authorization header with the scheme 'JWT':
55+
Authorization header with the scheme 'bearer':
5656

5757
```js
5858
var JwtStrategy = require('passport-jwt').Strategy,
5959
ExtractJwt = require('passport-jwt').ExtractJwt;
6060
var opts = {}
61-
opts.jwtFromRequest = ExtractJwt.fromAuthHeader();
61+
opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();
6262
opts.secretOrKey = 'secret';
6363
opts.issuer = 'accounts.examplesoft.com';
6464
opts.audience = 'yoursite.net';
@@ -97,8 +97,8 @@ functions return a new extractor configured with the given parameters.
9797
URL query parameter.
9898
* ```fromAuthHeaderWithScheme(auth_scheme)``` creates a new extractor that looks for the JWT in the
9999
authorization header, expecting the scheme to match auth_scheme.
100-
* ```fromAuthHeader()``` creates a new extractor that looks for the JWT in the authorization header
101-
with the scheme 'JWT'
100+
* ```fromAuthHeaderAsBearerToken()``` creates a new extractor that looks for the JWT in the authorization header
101+
with the scheme 'bearer'
102102
* ```fromExtractors([array of extractor functions])``` creates a new extractor using an array of
103103
extractors provided. Each extractor is attempted in order until one returns a token.
104104

‎lib/extract_jwt.js

+5-4
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,8 @@ var url = require('url'),
66
// Note: express http converts all headers
77
// to lower case.
88
var AUTH_HEADER = "authorization",
9-
DEFAULT_AUTH_SCHEME = "JWT";
9+
LEGACY_AUTH_SCHEME = "JWT",
10+
BEARER_AUTH_SCHEME = 'bearer';
1011

1112

1213
var extractors = {};
@@ -66,8 +67,8 @@ extractors.fromAuthHeaderWithScheme = function (auth_scheme) {
6667

6768

6869

69-
extractors.fromAuthHeader = function () {
70-
return extractors.fromAuthHeaderWithScheme(DEFAULT_AUTH_SCHEME);
70+
extractors.fromAuthHeaderAsBearerToken = function () {
71+
return extractors.fromAuthHeaderWithScheme(BEARER_AUTH_SCHEME);
7172
};
7273

7374

@@ -103,7 +104,7 @@ extractors.fromExtractors = function(extractors) {
103104
* tokenQueryParameterName: Query parameter name containing the token. Default is auth_token.
104105
*/
105106
extractors.versionOneCompatibility = function (options) {
106-
var authScheme = options.authScheme || DEFAULT_AUTH_SCHEME,
107+
var authScheme = options.authScheme || LEGACY_AUTH_SCHEME,
107108
bodyField = options.tokenBodyField || 'auth_token',
108109
queryParam = options.tokenQueryParameterName || 'auth_token';
109110

‎test/extrators-test.js

+4-4
Original file line numberDiff line numberDiff line change
@@ -144,11 +144,11 @@ describe('Token extractor', function() {
144144

145145
describe('fromAuthHeader', function() {
146146

147-
var extractor = extract_jwt.fromAuthHeader();
147+
var extractor = extract_jwt.fromAuthHeaderAsBearerToken();
148148

149149
it('should return the value from the authorization header with default JWT auth scheme', function() {
150150
var req = new Request()
151-
req.headers['authorization'] = "JWT abcd123";
151+
req.headers['authorization'] = "bearer abcd123";
152152

153153
var token = extractor(req);
154154

@@ -169,7 +169,7 @@ describe('Token extractor', function() {
169169
});
170170

171171

172-
var extractor = extract_jwt.fromExtractors([extract_jwt.fromAuthHeader(), extract_jwt.fromHeader('authorization')]);
172+
var extractor = extract_jwt.fromExtractors([extract_jwt.fromAuthHeaderAsBearerToken(), extract_jwt.fromHeader('authorization')]);
173173

174174
it('should return null when no extractor extracts token', function() {
175175
var req = new Request();
@@ -192,7 +192,7 @@ describe('Token extractor', function() {
192192

193193
it('should return token found by first extractor', function() {
194194
var req = new Request()
195-
req.headers['authorization'] = "JWT abcd123";
195+
req.headers['authorization'] = "bearer abcd123";
196196

197197
var token = extractor(req);
198198

‎test/strategy-validation-test.js

+7-7
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ describe('Strategy', function() {
2222
clockTolerance: 10,
2323
maxAge: "1h",
2424
};
25-
options.jwtFromRequest = extract_jwt.fromAuthHeader();
25+
options.jwtFromRequest = extract_jwt.fromAuthHeaderAsBearerToken();
2626
strategy = new Strategy(options, verifyStub);
2727

2828
Strategy.JwtVerifier = sinon.stub();
@@ -33,7 +33,7 @@ describe('Strategy', function() {
3333
done();
3434
})
3535
.req(function(req) {
36-
req.headers['authorization'] = "JWT " + test_data.valid_jwt.token;
36+
req.headers['authorization'] = "bearer " + test_data.valid_jwt.token;
3737
})
3838
.authenticate();
3939
});
@@ -82,7 +82,7 @@ describe('Strategy', function() {
8282
var strategy, payload;
8383

8484
before(function(done) {
85-
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeader(), secretOrKey: 'secret'}, function(jwt_payload, next) {
85+
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeaderAsBearerToken(), secretOrKey: 'secret'}, function(jwt_payload, next) {
8686
payload = jwt_payload;
8787
next(null, {}, {});
8888
});
@@ -96,7 +96,7 @@ describe('Strategy', function() {
9696
done();
9797
})
9898
.req(function(req) {
99-
req.headers['authorization'] = "JWT " + test_data.valid_jwt.token;
99+
req.headers['authorization'] = "bearer " + test_data.valid_jwt.token;
100100
})
101101
.authenticate();
102102
});
@@ -116,7 +116,7 @@ describe('Strategy', function() {
116116

117117
before(function(done) {
118118

119-
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeader(), secretOrKey: 'secret'}, verify_spy);
119+
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeaderAsBearerToken(), secretOrKey: 'secret'}, verify_spy);
120120

121121
// Mock errored verification
122122
Strategy.JwtVerifier = sinon.stub();
@@ -128,7 +128,7 @@ describe('Strategy', function() {
128128
done();
129129
})
130130
.req(function(req) {
131-
req.headers['authorization'] = "JWT " + test_data.valid_jwt.token;
131+
req.headers['authorization'] = "bearer " + test_data.valid_jwt.token;
132132
})
133133
.authenticate();
134134
});
@@ -153,7 +153,7 @@ describe('Strategy', function() {
153153

154154
before(function(done) {
155155

156-
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeader(), secretOrKey: 'secret'}, verify_spy);
156+
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeaderAsBearerToken(), secretOrKey: 'secret'}, verify_spy);
157157

158158
chai.passport.use(strategy)
159159
.fail(function(i) {

‎test/strategy-verify-test.js

+10-10
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ describe('Strategy', function() {
1717
var strategy, user, info;
1818

1919
before(function(done) {
20-
strategy = new Strategy({jwtFromRequest:extract_jwt.fromAuthHeader(), secretOrKey: 'secret'}, function(jwt_paylod, next) {
20+
strategy = new Strategy({jwtFromRequest:extract_jwt.fromAuthHeaderAsBearerToken(), secretOrKey: 'secret'}, function(jwt_paylod, next) {
2121
return next(null, {user_id: 1234567890}, {foo:'bar'});
2222
});
2323

@@ -28,7 +28,7 @@ describe('Strategy', function() {
2828
done();
2929
})
3030
.req(function(req) {
31-
req.headers['authorization'] = "JWT " + test_data.valid_jwt.token;
31+
req.headers['authorization'] = "bearer " + test_data.valid_jwt.token;
3232
})
3333
.authenticate();
3434
});
@@ -54,7 +54,7 @@ describe('Strategy', function() {
5454
var strategy, info;
5555

5656
before(function(done) {
57-
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeader(), secretOrKey: 'secret'}, function(jwt_payload, next) {
57+
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeaderAsBearerToken(), secretOrKey: 'secret'}, function(jwt_payload, next) {
5858
return next(null, false, {message: 'invalid user'});
5959
});
6060

@@ -64,7 +64,7 @@ describe('Strategy', function() {
6464
done();
6565
})
6666
.req(function(req) {
67-
req.headers['authorization'] = "JWT " + test_data.valid_jwt.token;
67+
req.headers['authorization'] = "bearer " + test_data.valid_jwt.token;
6868
})
6969
.authenticate();
7070
});
@@ -84,7 +84,7 @@ describe('Strategy', function() {
8484
var strategy, err;
8585

8686
before(function(done) {
87-
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeader(), secretOrKey: 'secrety'}, function(jwt_payload, next) {
87+
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeaderAsBearerToken(), secretOrKey: 'secrety'}, function(jwt_payload, next) {
8888
return next(new Error("ERROR"), false, {message: 'invalid user'});
8989
});
9090

@@ -94,7 +94,7 @@ describe('Strategy', function() {
9494
done();
9595
})
9696
.req(function(req) {
97-
req.headers['authorization'] = "JWT " + test_data.valid_jwt.token;
97+
req.headers['authorization'] = "bearer " + test_data.valid_jwt.token;
9898
})
9999
.authenticate();
100100
});
@@ -113,7 +113,7 @@ describe('Strategy', function() {
113113
var strategy, err;
114114

115115
before(function(done) {
116-
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeader(), secretOrKey: 'secret'}, function(jwt_payload, next) {
116+
strategy = new Strategy({jwtFromRequest: extract_jwt.fromAuthHeaderAsBearerToken(), secretOrKey: 'secret'}, function(jwt_payload, next) {
117117
throw new Error("EXCEPTION");
118118
});
119119

@@ -123,7 +123,7 @@ describe('Strategy', function() {
123123
done();
124124
})
125125
.req(function(req) {
126-
req.headers['authorization'] = "JWT " + test_data.valid_jwt.token;
126+
req.headers['authorization'] = "bearer " + test_data.valid_jwt.token;
127127
})
128128
.authenticate();
129129
});
@@ -145,7 +145,7 @@ describe('Strategy', function() {
145145
before(function(done) {
146146
opts = { passReqToCallback: true };
147147
opts.secretOrKey = 'secret';
148-
opts.jwtFromRequest = extract_jwt.fromAuthHeader();
148+
opts.jwtFromRequest = extract_jwt.fromAuthHeaderAsBearerToken();
149149
strategy = new Strategy(opts, function(request, jwt_payload, next) {
150150
// Capture the value passed in as the request argument
151151
request_arg = request;
@@ -157,7 +157,7 @@ describe('Strategy', function() {
157157
done();
158158
})
159159
.req(function(req) {
160-
req.headers['authorization'] = "JWT " + test_data.valid_jwt.token;
160+
req.headers['authorization'] = "bearer " + test_data.valid_jwt.token;
161161
expected_request = req;
162162
})
163163
.authenticate();

0 commit comments

Comments
 (0)