Registry / auth-security / passport-http

passport-http

library0.3.0jsnpmunverified

This package provides authentication strategies for HTTP Basic and HTTP Digest schemes, designed to integrate with the Passport.js authentication middleware for Node.js. It allows applications to secure endpoints using standard HTTP authentication headers, often used for API access or intranet applications. The current stable version is 0.3.0, last published nine years ago. This package is part of the original Passport ecosystem and differentiates itself by offering direct implementations of these fundamental HTTP authentication methods, enabling their use with any Connect/Express-style middleware. Its release cadence is non-existent, suggesting a mature but abandoned state, with focus on core functionality without frequent updates. While functional, developers should consider its age and lack of recent security patches.

auth-security web-framework http-networking

npm install passport-http

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · PASSPORT-HTTP

passport-http

auth-securityjavascriptv0.3.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

BasicStrategy

✓ import { BasicStrategy } from 'passport-http';

✗ const BasicStrategy = require('passport-http').Strategy;

BasicStrategy is a named export. Ensure you import the specific class.

DigestStrategy

✓ import { DigestStrategy } from 'passport-http';

✗ const DigestStrategy = require('passport-http').DigestStrategy;

DigestStrategy is a named export. Use named import syntax.

passport

✓ import passport from 'passport';

✗ const passport = require('passport-http');

The `passport` object itself comes from the `passport` package, not `passport-http`.

This example demonstrates configuring and using both HTTP Basic and HTTP Digest authentication strategies with Passport.js and Express, showcasing how to protect routes without requiring session management.

import express from 'express'; import passport from 'passport'; import { BasicStrategy, DigestStrategy } from 'passport-http'; const app = express(); const PORT = process.env.PORT || 3000; // A mock user database for demonstration const users = [ { id: 1, username: 'john', password: 'password', secret: 'shared-secret' }, { id: 2, username: 'jane', password: 'secure', secret: 'another-secret' } ]; // Basic Strategy Configuration passport.use(new BasicStrategy( function(userid, password, done) { const user = users.find(u => u.username === userid); if (!user) { return done(null, false); } if (user.password !== password) { return done(null, false); } return done(null, user); } )); // Digest Strategy Configuration passport.use(new DigestStrategy({ qop: 'auth' }, function(username, done) { const user = users.find(u => u.username === username); if (!user) { return done(null, false); } // For Digest, 'done' needs to provide the user and the shared secret (password) return done(null, user, user.secret); }, function(params, done) { // Optional: Validate nonce and other parameters to prevent replay attacks // For simplicity, we just accept for this example. done(null, true); } )); app.use(passport.initialize()); // Routes for HTTP Basic Authentication app.get('/basic-private', passport.authenticate('basic', { session: false }), function(req, res) { res.json({ message: 'Welcome to the basic private area!', user: req.user.username }); } ); // Routes for HTTP Digest Authentication app.get('/digest-private', passport.authenticate('digest', { session: false }), function(req, res) { res.json({ message: 'Welcome to the digest private area!', user: req.user.username }); } ); app.get('/', (req, res) => { res.send('Hello! Try accessing /basic-private or /digest-private with auth.'); }); app.listen(PORT, () => { console.log(`Server running on http://localhost:${PORT}`); console.log('Test Basic Auth with: curl -u john:password http://localhost:3000/basic-private'); console.log('Test Digest Auth with: curl --digest -u jane:another-secret http://localhost:3000/digest-private'); });

Debug

Known issues

gotchaThis package (v0.3.0) has not been updated in over nine years. While it may still function, it's not actively maintained, which can lead to compatibility issues with newer Node.js versions, updated Passport.js versions, or expose unpatched security vulnerabilities.

fix

Consider more modern authentication approaches (e.g., JWT, OAuth 2.0) or actively maintained Passport strategies, especially for new projects. If using, thoroughly test compatibility and review its source for potential security concerns.

affects: >=0.3.0

gotchaWhen using HTTP Basic or Digest authentication for APIs, sessions are typically not desired. Forgetting to set `session: false` in `passport.authenticate()` can lead to unexpected session creation or persistence behavior.

fix

Always include `{ session: false }` in `passport.authenticate('strategy', { session: false })` when using stateless HTTP authentication schemes.

affects: >=0.1.0

gotchaHTTP Basic Authentication sends credentials in plain text (Base64 encoded) and should *only* be used over HTTPS/TLS to prevent eavesdropping. HTTP Digest offers some protection but is considered less secure and more complex than modern token-based methods.

fix

Always deploy applications using Basic or Digest authentication with HTTPS/TLS enabled. For new applications, prefer token-based authentication (like JWT) over Digest for better security and flexibility.

affects: >=0.1.0

gotchaThe `done` callback in strategy verification functions has a specific signature: `done(error, user, info)`. Incorrectly calling `done` (e.g., `done(user)`) can lead to authentication failures, server errors, or incorrect user context.

fix

Ensure `done` is called correctly: `done(null, user)` on success, `done(null, false)` for failed authentication (e.g., wrong password), and `done(error)` for server errors.

affects: >=0.1.0

Errors

Common errors & fixes

Error: Unknown authentication strategy "basic"

The Passport BasicStrategy has not been properly configured or registered with `passport.use()` before `passport.authenticate('basic')` is called.

fix

Ensure `passport.use(new BasicStrategy(...))` is called and executed before any routes attempt to use the 'basic' strategy.

TypeError: BasicStrategy is not a constructor

This error typically occurs when attempting to call `BasicStrategy` as a function or if the import statement is incorrect (e.g., trying to default import a named export).

fix

Use `new BasicStrategy(...)` to instantiate the strategy. For CommonJS, ensure `const { BasicStrategy } = require('passport-http');` or `const BasicStrategy = require('passport-http').BasicStrategy;` is used. For ESM, `import { BasicStrategy } from 'passport-http';` is correct.

ReferenceError: User is not defined

The examples in the README use `User.findOne` and `user.verifyPassword` as placeholders, which assume you have a `User` model or equivalent logic defined to retrieve and validate user credentials.

fix

Replace `User.findOne` and `user.verifyPassword` with your actual user retrieval and password verification logic from your database or authentication system.

Upgrade

Version history

0.3.0latest on npm

Audit

Dependencies

passportrequiredThis package implements strategies for Passport.js, which is a required peer dependency for its functionality.

Agent activity

9 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/jaredhanson/passport-http ↗

packagehttps://www.npmjs.com/package/passport-http ↗

homepagehttp://passportjs.org ↗