Skip to content

casbin-jwt-express is an authorization middleware that uses stateless JWT token for Express.js based on Casbin

License

Notifications You must be signed in to change notification settings

tiagostutz/casbin-jwt-express

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

13 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Casbin JWT Express

casbin-jwt-express is an authorization middleware that uses stateless JWT token to validate ACL rules using Casbin

To see it in action, clone this repo, go to example folder and run npm install && npm start (https://github.com/tiagostutz/casbin-jwt-express/tree/master/example)

It uses loaded policy rules applied to the enforced user directly from the JWT, so the authorization rules used in the enforcement process are not validated from a server or a file, but from the JWT token itself.

Example

First install it:

npm i --save casbin-jwt-express

Then use it as a middleware:

    const jwtSecret = 'my-jwt-secret-used-to-sign-tokens'

    const modelSource = { fromText:  `[request_definition]
        r = sub, obj, act
        
        [policy_definition]
        p = sub, obj, act
        
        [policy_effect]
        e = some(where (p.eft == allow))
        
        [matchers]
        m = keyMatch(r.obj, p.obj) && (r.act == p.act || p.act == "*")
        `
  }

  app.use(casbinJWTExpress(modelSource, jwtSecret, "/security/login"))
  

JWT Spec

This middleware expects the underlying request to have an Authorization HTTP Header in format of Bearer <JWT_TOKEN>

The JWT token payload atteribute must having two attributes:

  • sub: the "user" (subject) of the rules to be applied. It must be your user identification on the systems. Can be an ID, a e-mail address, a login or whatever you use.
  • policy: has the policies (ACL) that will be used to enforce the subject (user) authorization

Middleware Initialization Parameters

  • modelSource: Can be a filePath for a model file or a JSON Object with the String representation of the model. In case of the JSON model, it must have a fromText attribute with the text representation of the model. See below an example.
  • jwtSecret: The secret used to sign the token so the middleware can decode the token and inspect its content. PS: Currently the middleware does not support certificate-based signature
  • ignoredPathsRegex: if you want some URL patterns to not be enforced (like login URL), you can pass an String with a single Path or a Regex to match.

About

casbin-jwt-express is an authorization middleware that uses stateless JWT token for Express.js based on Casbin

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published