Passport HTTP OAuth 1.0 Strategy

0.1.3 · abandoned · verified Wed Apr 22

This package provides an HTTP OAuth 1.0 authentication strategy for Passport.js, enabling authentication of requests using the authorization scheme defined by the OAuth 1.0 protocol. It ships with two primary strategies: `ConsumerStrategy` for authenticating consumers (clients) based on their keys and secrets, typically used for request token and access token endpoints, and `TokenStrategy` for authenticating subsequent API requests using previously issued access tokens. Last published in February 2013, with its current stable version being 0.1.3, this module is severely outdated. It targets Node.js versions `>= 0.4.0`, rendering it incompatible with modern Node.js environments and best practices. While OAuth 1.0 was a significant advancement, it has largely been superseded by OAuth 2.0 for new application development due to OAuth 2.0's simplified implementation, its reliance on HTTPS for security, and its greater flexibility for various client types beyond traditional web applications. This module is considered abandoned and should not be used in new projects or integrated into contemporary systems.

Common errors

Warnings

Install

Imports

Quickstart

This quickstart demonstrates how to configure and use `ConsumerStrategy` and `TokenStrategy` with Express and Passport.js for OAuth 1.0 authentication. It sets up mock consumer and token validation for illustrative purposes, emphasizing the distinct roles of each strategy for different OAuth 1.0 endpoints.

const express = require('express');
const passport = require('passport');
const { ConsumerStrategy, TokenStrategy } = require('passport-http-oauth');

const app = express();

// Minimal Passport setup for an API
app.use(passport.initialize());

// --- Consumer Strategy (for Request Token/Access Token Endpoints) ---
passport.use('consumer', new ConsumerStrategy(
  function(consumerKey, done) {
    // In a real app, look up consumerKey in your database
    if (consumerKey === 'myConsumerKey') {
      // Return consumer secret
      return done(null, { id: 'myConsumer', secret: 'myConsumerSecret' });
    } else {
      return done(null, false);
    }
  },
  function(consumer, done) {
    // This is typically for validating a temporary token if one is supplied
    // For initial request tokens, no token is present, so we just return the consumer.
    return done(null, consumer);
  },
  function(consumer, token, signature, params, done) {
    // In a real app, validate the request signature based on consumer, token, and parameters
    // This is a placeholder for actual signature verification logic
    const isValidSignature = true; // Replace with actual crypto-based validation
    if (isValidSignature) {
      return done(null, consumer);
    } else {
      return done(null, false, { message: 'Invalid signature.' });
    }
  }
));

// --- Token Strategy (for Protected API Endpoints) ---
passport.use('token', new TokenStrategy(
  function(consumerKey, done) {
    // In a real app, look up consumerKey in your database
    if (consumerKey === 'myConsumerKey') {
      return done(null, { id: 'myConsumer', secret: 'myConsumerSecret' });
    } else {
      return done(null, false);
    }
  },
  function(consumer, token, done) {
    // In a real app, look up token and token secret in your database
    if (token === 'myAccessToken') {
      // Typically return the user associated with this token
      return done(null, { id: 'userId123', name: 'Test User', tokenSecret: 'myAccessTokenSecret' });
    } else {
      return done(null, false);
    }
  },
  function(consumer, token, profile, signature, params, done) {
    // In a real app, validate the request signature
    const isValidSignature = true; // Replace with actual crypto-based validation
    if (isValidSignature) {
      return done(null, profile);
    } else {
      return done(null, false, { message: 'Invalid signature.' });
    }
  }
));

// Example: Request token endpoint protected by ConsumerStrategy
app.get('/oauth/request_token', passport.authenticate('consumer', { session: false }), (req, res) => {
  // Generate and return a request token here
  res.json({ message: 'Request token endpoint reached via Consumer Strategy!' });
});

// Example: Protected API endpoint using TokenStrategy
app.get('/api/resource', passport.authenticate('token', { session: false }), (req, res) => {
  res.json({ message: `Hello, ${req.user.name}! Access granted via Token Strategy.` });
});

const PORT = 3000;
app.listen(PORT, () => {
  console.log(`Server running on http://localhost:${PORT}`);
  console.log('Use tools like Postman to send requests with OAuth 1.0 Authorization header.');
  console.log('e.g., GET /api/resource with Authorization: OAuth consumer_key="myConsumerKey", oauth_token="myAccessToken", oauth_signature_method="HMAC-SHA1", oauth_timestamp="...", oauth_nonce="...", oauth_version="1.0", oauth_signature="..."');
});

view raw JSON →