passport-http-oauth

const express = require('express'); const passport = require('passport'); const { ConsumerStrategy, TokenStrategy } = require('passport-http-oauth'); const app = express(); // Minimal Passport setup for an API app.use(passport.initialize()); // --- Consumer Strategy (for Request Token/Access Token Endpoints) --- passport.use('consumer', new ConsumerStrategy( function(consumerKey, done) { // In a real app, look up consumerKey in your database if (consumerKey === 'myConsumerKey') { // Return consumer secret return done(null, { id: 'myConsumer', secret: 'myConsumerSecret' }); } else { return done(null, false); } }, function(consumer, done) { // This is typically for validating a temporary token if one is supplied // For initial request tokens, no token is present, so we just return the consumer. return done(null, consumer); }, function(consumer, token, signature, params, done) { // In a real app, validate the request signature based on consumer, token, and parameters // This is a placeholder for actual signature verification logic const isValidSignature = true; // Replace with actual crypto-based validation if (isValidSignature) { return done(null, consumer); } else { return done(null, false, { message: 'Invalid signature.' }); } } )); // --- Token Strategy (for Protected API Endpoints) --- passport.use('token', new TokenStrategy( function(consumerKey, done) { // In a real app, look up consumerKey in your database if (consumerKey === 'myConsumerKey') { return done(null, { id: 'myConsumer', secret: 'myConsumerSecret' }); } else { return done(null, false); } }, function(consumer, token, done) { // In a real app, look up token and token secret in your database if (token === 'myAccessToken') { // Typically return the user associated with this token return done(null, { id: 'userId123', name: 'Test User', tokenSecret: 'myAccessTokenSecret' }); } else { return done(null, false); } }, function(consumer, token, profile, signature, params, done) { // In a real app, validate the request signature const isValidSignature = true; // Replace with actual crypto-based validation if (isValidSignature) { return done(null, profile); } else { return done(null, false, { message: 'Invalid signature.' }); } } )); // Example: Request token endpoint protected by ConsumerStrategy app.get('/oauth/request_token', passport.authenticate('consumer', { session: false }), (req, res) => { // Generate and return a request token here res.json({ message: 'Request token endpoint reached via Consumer Strategy!' }); }); // Example: Protected API endpoint using TokenStrategy app.get('/api/resource', passport.authenticate('token', { session: false }), (req, res) => { res.json({ message: `Hello, ${req.user.name}! Access granted via Token Strategy.` }); }); const PORT = 3000; app.listen(PORT, () => { console.log(`Server running on http://localhost:${PORT}`); console.log('Use tools like Postman to send requests with OAuth 1.0 Authorization header.'); console.log('e.g., GET /api/resource with Authorization: OAuth consumer_key="myConsumerKey", oauth_token="myAccessToken", oauth_signature_method="HMAC-SHA1", oauth_timestamp="...", oauth_nonce="...", oauth_version="1.0", oauth_signature="..."'); });