passport.js strategy for authentication by a trusted HTTP header.
Node.js apps often have TLS handled by a front-end web server like nginx. For client cert authentication, the web server passes through certificate fields like DN as HTTP headers. The Node app can use these headers for authentication.
The connection between web server and web app must be secure. The front-end web server must whitelist HTTP headers to send to the web app, and it must be impossible for external processes to reach the web app or interfere with connections between the web server and Node.js. It is completely insecure if these conditions are not met!
Create the strategy with an options object and a "verify request" callback.
headers- required. Array of HTTP header names to extract. A request has to contain all of these headers to be authenticated.
passReqToCallback- optional. Causes the request object to be supplied to the verify callback as the first parameter.
The verify callback decides whether to authenticate each request. It called with the extracted header names/values and a passport.js
var passport = ;var Strategy = Strategy;var options =headers: 'TLS_CLIENT_DN'passport;
The verify callback can be supplied with the
request object by setting the
passReqToCallback option to
true, and changing callback arguments accordingly.
var options =headers: 'TLS_CLIENT_DN'passReqToCallback: truepassport;
$ npm install $ npm test
Contributions are welcome! Please write unit tests, follow the existing coding style and lint with eslint.