supermamon/node-restify-jwt-sample

A sample restify api service with JWT authentication

node-restify-jwt-sample

A sample api service with JWT authentication

What's Inside

• route path prefix
• versioned routes
• protected/unprotected routes
• registration
• admin/non-admin routes
• logging (using winston)
• unit tests

Configure

See /config/index.js

Examples

Use api/register to generate tokens.

$ curl -X POST \
> -H "Content-Type: application/json" \
> --data '{ "name": "Johnny Appleseed", "role": "test", "password":"some-hashed-password" }' \
http://localhost:8080/api/register

{"name":"Johnny Appleseed","role":"test","token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9obm55IEFwcGxlc2VlZCIsInJvbGUiOiJ0ZXN0IiwiaWF0IjoxNTA5MDc2MTEwfQ.EsRsidT33amgeDX8u6SlE6LwWUs2jpyblogOvLaJ1Y8"}

$ curl -X POST \
> -H "Content-Type: application/json" \
> --data '{ "name": "Tim Cook", "role": "admin", "password":"some-hashed-password" }' \
http://localhost:8080/api/register

{"name":"Tim Cook","role":"admin","token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiVGltIENvb2siLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE1MDkwNzY0NzB9.f5_v9HfOAiOS4IiiQ5Pj0IxLOMJGWUhHQ57Zd9opqwE"}

Route protection

$ curl localhost:8080/api/ping
{"ping":"OK"}

$ curl localhost:8080/api/home
{"code":"InvalidCredentials","message":"No authorization token was found"}

Protected route

$ curl -H "Authorization: Bearer your-token" localhost:8080/api/home
{"welcome":"Johnny Appleseed"}

Admin route

$ curl -H "Authorization: Bearer admin-token" localhost:8080/api/admin
{"action":"completed"}

$ curl -H "Authorization: Bearer user-token" localhost:8080/api/admin
{"code":"Forbidden","message":"You don't have sufficient priviledges."}

node-restify-jwt-sample's Issues

Postman can bypass protection and access admin-protected routes

I created a user with Postman and role : test .

Then I made a request with curl:

It works as expected: access denied.

Then I made exactly the same request again, with exactly the same token, but with Postman:

It bypasses protection and now I can access the admin-protected route with a test role.

Any user can access the admin-protected routes

I registered an user with somerandomrole.

/api/home works as expected.

However, it's allowed to access the admin-protected route /api/admin.

The expected result would be {"code":"Forbidden","message":"You don't have sufficient priviledges."}.

different methods to one path

how to create request with different methods or request with id to one path?

bug caused by restify-jwt-community:2.0.0

see frbuceta/restify-jwt-community#306

Password in token

In case the user sends its password during registration, the register example just adds the password to the base64 token.
I know this is just an example and you don't pretend to provide an introduction to good security practices, but considering that a lot of newbies will just copypasta your code, this point should be at least explained.

const token = jwt.sign(req.body, config.JWT_SECRET)

should become something like :

// Only put the username in the token, please read about JWT
let user = {name: req.body.name}
const token = jwt.sign(user, config.JWT_SECRET)