The `http-auth` package provides robust HTTP basic and digest access authentication capabilities for Node.js applications. Currently stable at version 4.2.1, it receives infrequent but consistent updates, addressing security and dependency concerns (e.g., uuid updates, security fixes in 4.1.3). It differentiates itself by offering built-in support for both basic and digest authentication schemes, configurable realms, and flexible user credential storage, including file-based methods (e.g., `.htpasswd` format). While primarily designed for CommonJS environments, it offers a straightforward API for integrating authentication into standard Node.js HTTP servers, allowing developers to define custom user stores via file paths or callback functions, and customize authentication parameters like algorithm (MD5, MD5-sess) and Quality of Protection (QOP) for digest authentication.
npm install http-authVerified import paths — ran on the pinned version, not inferred.
This quickstart sets up a basic HTTP server with HTTP Basic Authentication, reading user credentials from a temporary `.htpasswd` file. It demonstrates how to initialize the `basic` authentication middleware and integrate it into a standard Node.js `http.createServer` callback.
Ensure your project is configured for CommonJS, or use a build tool like Webpack/Rollup that can transpile CommonJS modules for ESM environments. If using Node.js ESM, you must use `createRequire` or a dynamic import (`await import()`) if absolutely necessary, but it's generally recommended for CJS-only packages to stick to `require()` environments.
Upgrade to `http-auth` version 4.1.3 or newer to patch known security issues: `npm install http-auth@latest`.
Consider contributing `d.ts` files to the project, providing a `types/http-auth/index.d.ts` file in your project, or looking for community-maintained types (e.g., `@types/http-auth`, though none exist currently).
For production, integrate with more secure authentication backends such as databases with strong hashing (e.g., bcrypt), external identity providers, or OAuth/OIDC systems. If file-based is unavoidable, ensure robust file system permissions and use strong hashing algorithms provided by utilities like `htpasswd` or `htdigest` with modern secure options.
Change your project's `package.json` to `"type": "commonjs"` or rename your script file to have a `.cjs` extension. If you must use ESM, consider using a dynamic import: `const auth = await import('http-auth').then(m => m.default || m);` (though this package exports directly, not a default).Ensure that `const auth = require("http-auth");` is present and executed correctly before you try to call `auth.basic` or `auth.digest`. This often happens if the `require` statement is conditional or placed incorrectly.Verify the `file` path is correct and absolute. Use `path.join(__dirname, 'data', 'users.htpasswd')` for relative paths within your project. Ensure the Node.js process has read permissions for the file.
No dependency data recorded yet.