http-auth-passport provides an integration layer that allows the use of the `http-auth` module's HTTP Basic and Digest access authentication within the Passport.js framework. This package enables developers to easily implement traditional HTTP authentication schemes in their Node.js applications, particularly those built with Express.js, leveraging Passport's robust strategy pattern. The current stable version is 1.0.7, with its last known release in 2021. The package itself has received minimal updates since then, indicating a slow maintenance cadence primarily focused on critical bug fixes or essential dependency alignments rather than active feature development. It serves a niche by bridging `http-auth`'s specific capabilities with the broader Passport ecosystem, offering an alternative to direct implementations like `passport-http` when `http-auth`'s features are preferred.
npm install http-auth-passportVerified import paths — ran on the pinned version, not inferred.
This quickstart sets up an Express server that utilizes `http-auth-passport` to protect a route with HTTP Basic Authentication. It demonstrates defining a basic authentication realm using a `.htpasswd` file, integrating this realm as a Passport strategy, and securing an endpoint without maintaining user sessions. The example includes the creation of a temporary `.htpasswd` file for immediate testing.
For ESM projects, consider dynamic `import()` or transpiling your code. Alternatively, ensure your project supports CommonJS modules via Node.js's default interoperability or a bundler.
Carefully test compatibility with your specific `passport` version. Consult `passport`'s changelog for breaking changes affecting strategy integration. For active development, consider alternative, more actively maintained Passport strategies like `passport-http` if the unique features of `http-auth` are not strictly necessary.
If session support is needed, ensure `express-session` and `passport.session()` middleware are correctly configured and placed before `passport.authenticate()` in your middleware stack. Then, remove the `session: false` option from the `authenticate` call.
Always deploy applications utilizing HTTP Basic authentication with HTTPS enabled to encrypt traffic. For enhanced security, consider more robust authentication mechanisms such as token-based (e.g., JWT with OAuth 2.0 Bearer tokens) or Digest authentication.
Regularly monitor the `http-auth` project for security advisories. Evaluate if migrating to a more actively maintained direct Passport strategy like `passport-http` for Basic/Digest authentication would be a more sustainable long-term solution, if `http-auth` specific functionalities are not critical.
Verify that the `file` property in your `auth.basic()` configuration uses an absolute path (`path.join(__dirname, 'yourfile.htpasswd')` is recommended) and that the file is readable by the Node.js process. Confirm the file content adheres to the `http-auth` module's specified format.
Ensure `http-auth` is correctly installed via `npm install http-auth`. Verify your import statement is `const auth = require('http-auth');`. If the issue persists, check `http-auth`'s documentation for any breaking changes in its API.Confirm that `passport.use(authPassport(basic));` is executed prior to any route that calls `passport.authenticate('http', ...)`. Ensure `authPassport` is correctly imported from `http-auth-passport` and that the `basic` instance is properly configured.Check the username and password being sent in the `Authorization` header. Verify that the `.htpasswd` file's content or the custom credential callback's logic matches the expected values. Ensure the client (e.g., browser or API tool) is correctly sending the HTTP Basic Authorization header with each request.