# Authentication using passport-jwt

**URL:** <https://discourse.nodered.org/t/authentication-using-passport-jwt/22345>\
**Category:** General\
**Created:** [28 February 2020 00:50 UTC](https://discourse.nodered.org/t/authentication-using-passport-jwt/22345 "2020-02-28T00:50:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![acoulson2000](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/acoulson2000/32/21388_2.png) [@acoulson2000](https://discourse.nodered.org/u/acoulson2000)\
**Post date:** [28 February 2020 00:50 UTC](https://discourse.nodered.org/t/authentication-using-passport-jwt/22345/1 "2020-02-28T00:50:54Z")

</div>

I'm trying to setup authentication using the passport-jwt strategy, but am so far having now luck. I want to pass the JWT token as a query parameter for authentication  
I first tried using the passports `fromUrlQueryParameter` extractor with a very simple verifier:

> ```
> type: "strategy",
> strategy: {
> name: "jwt",
> label: 'Authenticate via JWT token',
> icon:"fa-cloud",
> strategy: require("passport-jwt").Strategy,
> options: {
> secretOrKey : "<secret>",
> jwtFromRequest: require('passport-jwt').ExtractJwt.fromUrlQueryParameter("token"),
> verify: function(jwt_payload, done) {
> console.log("JWT_PAYLOAD was :" + jwt_payload);
> return done(null, "Andrew");
> }
> },
> },
> 
> ```

I hit [http://localhost:1880/auth/strategy?token=my\_valid\_token](http://localhost:1880/auth/strategy?token=my_valid_token) and I just get bounced to a login page with a button to login. The clicking the button just lands me back at the login page. Nothing is logged from the verify function.

I thought I'd try to verify the strategy is getting invoked by replacing the extractor with my own function that includes some logging:

> ```
> type: "strategy",
> strategy: {
> name: "jwt",
> label: 'Authenticate via JWT token',
> icon:"fa-cloud",
> strategy: require("passport-jwt").Strategy,
> options: {
> secretOrKey : "<secret>",
> jwtFromRequest: function(req) {
> console.log("jwtFromRequest called with:" + req.query.token);
> return req.query.token;
> },
> verify: function(jwt_payload, done) {
> console.log("JWT_PAYLOAD was :" + jwt_payload);
> return done(null, "Andrew");
> }
> },
> },
> 
> ```

This DOES log my token, but I still see nothing logged from the verify function and I get bounced to the login panel.

Any suggestions about what I might be doing wrong?

---

<div class="post-metadata">

**Author:** ![acoulson2000](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/acoulson2000/32/21388_2.png) [@acoulson2000](https://discourse.nodered.org/u/acoulson2000)\
**Post date:** [28 February 2020 00:58 UTC](https://discourse.nodered.org/t/authentication-using-passport-jwt/22345/2 "2020-02-28T00:58:06Z")

</div>

I've also tried just hitting [http://localhost:1880/?token=my\_token](http://localhost:1880/?token=my_token) and [http://localhost:1880/auth/strategy/callback?token=my\_token](http://localhost:1880/auth/strategy/callback?token=my_token)

Same result.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [28 February 2020 14:59 UTC](https://discourse.nodered.org/t/authentication-using-passport-jwt/22345/3 "2020-02-28T14:59:08Z")

</div>

Hi @acoulson2000

the Strategy authentication type is only intended for OAuth/OpenID based strategies that require the user to be redirected to a 3rd party site to do the authentication. passport-jwt doesn't fit that model.

We are currently working on a new addition to the adminAuth configuration that can be used to validate requests using an externally generated token, rather than require it to use a token generated by Node-RED.

The current design assumes the token is provided by HTTP header - but I see your want to provide it via a query parameter. That is something we could consider incorporating into the design.

> <https://github.com/node-red/designs/blob/master/designs/admin-api-authentication.md>

---

<div class="post-metadata">

**Author:** ![acoulson2000](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/acoulson2000/32/21388_2.png) [@acoulson2000](https://discourse.nodered.org/u/acoulson2000)\
**Post date:** [28 February 2020 15:27 UTC](https://discourse.nodered.org/t/authentication-using-passport-jwt/22345/4 "2020-02-28T15:27:18Z")

</div>

Hmm, timely proposal!

We don't strictly need the query parameter option, as we would be constructing the request from a service in the same domain, although it would certainly be nice.

How long would it typically take for a proposal like this to make it's way into a release?

I guess for the the time being, we can use a custom authenticator, post our JWT token in the password, and do our own validation.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [28 February 2020 15:55 UTC](https://discourse.nodered.org/t/authentication-using-passport-jwt/22345/5 "2020-02-28T15:55:46Z")

</div>

> [@acoulson2000](#):
>
> How long would it typically take for a proposal like this to make it's way into a release?

There isn't really a 'typical' to cite 🙂

In this instance, we know there is a specific need for it from the team who have contributed the design and there is a PR already in-flight - [Add admin api authentication function by KazuhiroItoh · Pull Request #2479 · node-red/node-red · GitHub](https://github.com/node-red/node-red/pull/2479)

So it _definitely will_ be in Node-RED 1.1.0. I just don't yet have a timescale for when that release will be - probably within the next 2 months.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [28 April 2020 15:55 UTC](https://discourse.nodered.org/t/authentication-using-passport-jwt/22345/6 "2020-04-28T15:55:46Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.