passport-http-header-strategy

import express from 'express'; import passport from 'passport'; import { Strategy } from 'passport-http-header-strategy'; const app = express(); app.use(express.json()); // For parsing req.body if 'param' option is used // Mock user database for demonstration const users = [ { id: 1, username: 'testuser', token: 'mysecrettoken123' }, { id: 2, username: 'admin', token: 'adminsecuretoken' } ]; // Configure the HTTP Header Strategy passport.use('header-token', new Strategy({ header: 'X-APP-TOKEN', // Name of the header to check for the token param: 'app_token', // Optional: Name of param in req.body/req.query if header isn't found passReqToCallback: true // Pass the request object to the verify callback }, function(req, token, done) { console.log(`Attempting authentication with token: ${token} from header: ${req.headers['x-app-token']}`); const user = users.find(u => u.token === token); if (!user) { return done(null, false, { message: 'Invalid token provided.' }); } // In a real application, perform secure token validation (e.g., database lookup, JWT verification) return done(null, user, { scope: 'all' }); } )); // Protected route using the 'header-token' strategy app.get('/protected', passport.authenticate('header-token', { session: false }), function(req, res) { res.json({ message: `Hello, ${req.user.username}! This is a protected resource.`, user: req.user }); } ); // Unprotected root route app.get('/', (req, res) => { res.send('Welcome. Try GET /protected with an X-APP-TOKEN header.'); }); const PORT = process.env.PORT || 3000; app.listen(PORT, () => { console.log(`Server running on http://localhost:${PORT}`); console.log('Test with cURL:'); console.log(`curl -H "X-APP-TOKEN: mysecrettoken123" http://localhost:${PORT}/protected`); console.log(`curl http://localhost:${PORT}/protected`); // Should result in 401 Unauthorized });