From fc88803de9e940fc537e53605b3e259068434a95 Mon Sep 17 00:00:00 2001 From: Florian Didron Date: Tue, 23 Feb 2016 15:59:46 +0900 Subject: [PATCH 1/5] Adds ability to pass the token via the query string --- lib/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/index.js b/lib/index.js index 46f95d6..f05b252 100755 --- a/lib/index.js +++ b/lib/index.js @@ -33,7 +33,7 @@ internals.implementation = function (server, options) { authenticate: function (request, reply) { var req = request.raw.req; - var authorization = req.headers.authorization; + var authorization = req.headers.authorization || (typeof settings.queryString === String) ? req.query[settings.queryString] || undefined; if (!authorization) { return reply(Boom.unauthorized(null, 'Bearer')); } From 4c5e418e24958ee75dff6ec49122bb307f35ae90 Mon Sep 17 00:00:00 2001 From: Florian Didron Date: Tue, 23 Feb 2016 17:08:43 +0900 Subject: [PATCH 2/5] Makes queryString an option --- lib/index.js | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/lib/index.js b/lib/index.js index f05b252..53b5bfd 100755 --- a/lib/index.js +++ b/lib/index.js @@ -33,9 +33,14 @@ internals.implementation = function (server, options) { authenticate: function (request, reply) { var req = request.raw.req; - var authorization = req.headers.authorization || (typeof settings.queryString === String) ? req.query[settings.queryString] || undefined; + var authorization = req.headers.authorization; if (!authorization) { - return reply(Boom.unauthorized(null, 'Bearer')); + if(typeof settings.verifyOptions.queryString === 'string' && request.query[settings.verifyOptions.queryString]) { + authorization = request.query[settings.verifyOptions.queryString]; + } + else{ + return reply(Boom.unauthorized(null, 'Bearer')); + } } var parts = authorization.split(/\s+/); From 358fc2ee96e0487e64d399b8d8578a331c6566b6 Mon Sep 17 00:00:00 2001 From: Florian Didron Date: Tue, 23 Feb 2016 17:09:15 +0900 Subject: [PATCH 3/5] Adding tests for queryString option --- test/index.js | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) diff --git a/test/index.js b/test/index.js index e0e7aa7..2b49ee1 100755 --- a/test/index.js +++ b/test/index.js @@ -18,6 +18,9 @@ var expect = Code.expect; describe('Token', function () { var privateKey = 'PajeH0mz4of85T9FB1oFzaB39lbNLbDbtCQ'; + var server = new Hapi.Server({ debug: false }); + server.connection(); + var tokenHeader = function (username, options) { options = options || {}; @@ -58,9 +61,6 @@ describe('Token', function () { }); }; - var server = new Hapi.Server({ debug: false }); - server.connection(); - before(function (done) { server.register(require('../'), function (err) { @@ -123,6 +123,33 @@ describe('Token', function () { }); }); + it('returns a reply on successful auth with queryString as option', function (done) { + + var handler = function (request, reply) { + reply('ok'); + }; + + var s = new Hapi.Server({ debug: false }); + s.connection(); + s.register(require('../'), function (err) { + expect(err).to.not.exist; + + s.auth.strategy('default', 'jwt', 'required', { key: privateKey, verifyOptions: { queryString : 'access_token' } }); + + s.route([ + { method: 'GET', path: '/token', handler: handler, config: { auth: 'default' } } + ]); + }); + + var request = { method: 'GET', url: '/token?access_token=' + tokenHeader('john', { queryString : 'access_token' }) }; + + s.inject(request, function (res) { + expect(res.result).to.exist; + expect(res.result).to.equal('ok'); + done(); + }); + }); + it('returns a 401 unauthorized error when algorithm do not match', function (done) { var handler = function (request, reply) { From 18456c7c23c9a4465887a4388c3cefd2f942a0f3 Mon Sep 17 00:00:00 2001 From: Florian Didron Date: Tue, 23 Feb 2016 17:29:32 +0900 Subject: [PATCH 4/5] Adds Bearer to the queryString token --- lib/index.js | 2 +- test/index.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/index.js b/lib/index.js index 53b5bfd..0e26bd2 100755 --- a/lib/index.js +++ b/lib/index.js @@ -36,7 +36,7 @@ internals.implementation = function (server, options) { var authorization = req.headers.authorization; if (!authorization) { if(typeof settings.verifyOptions.queryString === 'string' && request.query[settings.verifyOptions.queryString]) { - authorization = request.query[settings.verifyOptions.queryString]; + authorization = 'Bearer ' + request.query[settings.verifyOptions.queryString]; } else{ return reply(Boom.unauthorized(null, 'Bearer')); diff --git a/test/index.js b/test/index.js index 2b49ee1..fa48469 100755 --- a/test/index.js +++ b/test/index.js @@ -141,7 +141,7 @@ describe('Token', function () { ]); }); - var request = { method: 'GET', url: '/token?access_token=' + tokenHeader('john', { queryString : 'access_token' }) }; + var request = { method: 'GET', url: '/token?access_token=' + tokenHeader('john', { queryString : 'access_token' }).split(/\s+/)[1] }; s.inject(request, function (res) { expect(res.result).to.exist; From 738a592148cc5f86a6fe5986f6480c85f227cad8 Mon Sep 17 00:00:00 2001 From: Florian Didron Date: Tue, 23 Feb 2016 17:43:15 +0900 Subject: [PATCH 5/5] Updates Readme with the queryString usage --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b95acb1..837cd39 100755 --- a/README.md +++ b/README.md @@ -22,6 +22,7 @@ JSON Web Token authentication requires verifying a signed token. The `'jwt'` sch - `issuer`: if you want to check issuer (`iss`), provide a value here - `ignoreExpiration`: if `true` do not validate the expiration of the token. - `maxAge`: optional sets an expiration based on the `iat` field. Eg `2h` + - `queryString`: optional if set to a string (e.g. `access_token`), allows passing the token via a query parameter See the example folder for an executable example. @@ -97,4 +98,4 @@ server.register(require('hapi-auth-jwt'), function (error) { server.start(); -``` \ No newline at end of file +```