ExpressJS - JWT and Passport Implementation

Question

I'm currently trying to learn JWT and Passport for ExpressJS while trying them out but I can't seem to grasp the idea of how Passport works.

Here's what I have done initially in my ExpressJS application.

/api/login POST API

• Accepts username and password
• /api/login then creates a JWT with the username and password as the payload
• The token is then responded to the client

I think my /api/login API simulates the general idea of JWT of hard authenticate once and respond with token.

/api/test GET API on the other hand

• Only authenticated users can access
• Simply returns "Hello World!"

What is the problem/s?

• My code doesn't seem to validate the token (I tried putting the token in Authenticate header.
• Where in my request should I include the token returned from /api/login when requesting to /api/test?

Now to my actual code:

app.js

var express = require("express");
var bodyParser = require("body-parser");
var jwt = require("jsonwebtoken");
var passport = require("passport");
var LocalStrategy = require('passport-local').Strategy;
var mySecret = "mySecret";
var app = express();
var port = process.env.PORT || 3000;

app.use(bodyParser.json());

passport.use(new LocalStrategy(
    function (token, done) {
        var credentials = jwt.verify(token, mySecret);
        if (credentials.username == "test" && credentials.password == "test") {
            return done(null, credentials);
        } else {
            return done(null, false);
        }
    }
));

app.use(passport.initialize());

app.post("/api/login", function (request, response) {
    var user = {
        "username": request.body.username,
        "password": request.body.password
    };
    response.send(jwt.sign(user, "mySecret"));
});

app.get("/api/test", passport.authenticate("local", {
    "session": false
}), function (request, response) {
    response.send("Hello World!");
});

app.listen(port, function () {
    console.log("Listening on port: " + port);
});

Answer 1

You need to configure jwtStratagy also to authenticate the user. here is working example: -

const express = require("express");
const bodyParser = require("body-parser");
const jwt = require("jsonwebtoken");
console.log(jwt.verify);
const passport = require("passport"),
  LocalStrategy = require("passport-local").Strategy;
const cors = require("cors");
const app = express();
app.use(cors());
app.use(bodyParser.json());
app.use(passport.initialize());
var secret = '11210646';
var JwtStrategy = require('passport-jwt').Strategy,
  ExtractJwt = require('passport-jwt').ExtractJwt;
passport.use(new LocalStrategy({
    usernameField: 'username',
    passwordField: 'password',
    passReqToCallback: true
  },
  function(req, username, password, done) {
    console.log('ohh', username, password);
    let err = null;
    if (err) { return done(err); }
    if (username != 'abhi') {
      return done(null, false, { message: 'Incorrect username.' });
    }
    if (password != 'pass') {
      return done(null, false, { message: 'Incorrect password.' });
    }
    return done(null, username);

  }
));
app.post('/login', function(req, res, next) {
  passport.authenticate('local', function(err, user, info) {
    console.log(err, user, info);
    if (err) { return next(err); }
    if (!user) { res.send({ "status": info.message }); }
    res.send({ "status": user });
  })(req, res, next);
});
var opts = {
  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
  secretOrKey: secret,
  issuer: 'jonu',
  audience: 'jonu bhai',
  passReqToCallback: false
};
app.post('/me2', function(req, res, next) {
  passport.authenticate('jwt', { session: false }, function(err,user, info) {
    if (err) { return next(err); }
    if (!user) { res.send({ "status": info.message }); }
    res.send({ "status": user });
  })(req, res, next);

});
//jwt

passport.use(new JwtStrategy(opts, function(jwt_payload, done) {
  let err = null;
  if (err) {
    return done(err, false);
  }
  if (jwt_payload) {
    return done(null, jwt_payload);
  }
  else {
    return done(null, false);
    // or you could create a new account
  }

}));


app.post('/signup', (req, res) => {

  let token = jwt.sign({
      user: {
        id: "idididid",
        name: "Abhishek Singh",
        username: "abhishek11210646"
      }
    },
    secret, {
      algorithm: 'HS256',
      expiresIn: '5h',
      issuer: 'jonu',
      audience: 'jonu bhai'
    });
  res.send({ "token": token });
});

app.get('/', (req, res) => {
  res.send({ "status": "Up and Running..." });
});

app.listen(8080, () => {
  console.log('server running');
});