Registry / auth-security / passport-http-custom-bearer

passport-http-custom-bearer

library1.0.15jsnpmunverified

Passport strategy for HTTP Bearer authentication using custom header, body field, or query parameter names (rather than the standard Authorization header). Version 1.0.15 is the latest stable release; the package sees infrequent updates. It forks passport-http-bearer to allow configurable field names like X-APIAuth or api_token. Key differentiator: flexibility for non-standard token placements, commonly used in legacy or custom API gateway setups. Supports Node >=0.4.0 and works with Express/Connect-style middleware.

auth-security web-framework

npm install passport-http-custom-bearer

github ↗package ↗

INSTALL

IMPORT

SIG · PASSPORT-HTTP-CUST

passport-http-custom-bearer

auth-securityjavascriptv1.0.15

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default (CustomBearerStrategy)

✓ import CustomBearerStrategy from 'passport-http-custom-bearer'

✗ const { CustomBearerStrategy } = require('passport-http-custom-bearer')

Default export only; named import will return undefined.

Strategy

✓ import Strategy from 'passport-http-custom-bearer'

✗ import { Strategy } from 'passport-http-custom-bearer'

The module exports the constructor as default; Strategy is not a named export.

require usage

✓ const CustomBearerStrategy = require('passport-http-custom-bearer')

✗ const { default } = require('passport-http-custom-bearer')

CommonJS require returns the constructor directly, not an object.

Configures CustomBearerStrategy with custom header/body/query field names and uses it in an Express route.

import passport from 'passport'; import CustomBearerStrategy from 'passport-http-custom-bearer'; passport.use('api-bearer', new CustomBearerStrategy( { headerName: 'APIAuth', bodyName: 'api_token', queryName: 'api_token' }, (token, done) => { // Replace with actual user lookup if (token === 'valid-token') { return done(null, { id: 1, name: 'John' }, { scope: 'read' }); } return done(null, false); } )); // Express route example import express from 'express'; const app = express(); app.get('/profile', passport.authenticate('api-bearer', { session: false }), (req, res) => { res.json(req.user); });

Debug

Known issues

gotchaThe `headerName` option automatically prepends 'X-' prefix. For example, setting `headerName: 'APIAuth'` expects header `X-APIAuth`.

fix

If you want an exact header name without prefix, set headerName to include 'X-' yourself or use a workaround.

affects: >=1.0.0

deprecatedThe default strategy name is 'custom-bearer'. In some documentation it's referred to as 'bearer'.

fix

Always specify a custom name like 'api-bearer' to avoid confusion.

affects: >=1.0.0

gotchaThe strategy does not automatically strip the token from query or body after authentication. You must manually delete it in a custom callback if needed.

fix

Use passport.authenticate with a custom callback and delete req.query[info.queryName] or req.body[info.bodyName].

affects: >=1.0.0

breakingPassport 0.7+ changed the internal callback signature. This strategy may not work with Passport >=0.7 without adaptation.

fix

Use Passport 0.6.x or test with newer versions carefully.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: CustomBearerStrategy is not a constructor

Using named import instead of default import in ESM.

fix

Use `import CustomBearerStrategy from 'passport-http-custom-bearer'` (no curly braces).

Cannot find module 'passport-http-custom-bearer'

Module not installed or typo in package name.

fix

Run `npm install passport-http-custom-bearer` and verify package.json.

UnauthorizedError: No auth token

Token not found because custom header/field name is not being sent by client.

fix

Ensure client sends token in the expected header (e.g., X-APIAuth), body field (api_token), or query parameter (api_token).

Upgrade

Version history

1.0.15latest on npm

Audit

Dependencies

passport-strategyrequiredBase class for Passport strategies

Agent activity

13 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/wwwslinger/passport-http-custom-bearer ↗

packagehttps://www.npmjs.com/package/passport-http-custom-bearer ↗