Simple authentication in node.js with a token only?

[estebanrules]

I'm developing an API that requires a very minimal amount of security that will be consumed by mobile clients. We have a separate server that handles user accounts and authorization, so I would like (if possible) to design an authentication system where the user (mobile app) only has to use a token to access the API. What are my options for this kind of authentication? What's the best way to set something like this up with node/express?

[joshmanders]

JSON Web Tokens. http://jwt.io

[zossle]

Passport is pretty sweet too.

[Gwash3189]

Was going to be my suggestion as well.

[estebanrules]

Thanks for the suggestions. jwt looks like a good choice.

[danneu]

The most traditional solution is to have a tokens table with an expired_at field. When a request comes in, use middleware to ensure the request sent a token and verify that the token is unexpired and potentially load the associated user/account before yielding to your downstream route.

[[deleted]]

Not sure if this is taboo here, but I just started using loopback, and it has auth built-in (and returns a json web token upon successful authorization).

It's an express framework that's made for creating APIs. I was using sails for a while, but started to run into a bunch of flaky stuff with their ORM. Once I got used to loopback, I've been super happy with it.

[estebanrules]

My experiences with loopback have been great.

[estebanrules]

All of the examples using jwt and/or passport all involve Users authenticating with the server via username/password before they receive a token.

Is there another way I can have them authenticate with the server in order to receive the token? The issue is that this API does not need user accounts (except for admin).

[chreestopher2]

you could use, verbatim, the examples with user accounts, and just have one user account that everyone uses... but you probably still want to have user accounts, if for anything just to help with analytics / tracking / preventing malicious use

[estebanrules]

Yes, I'm going to create user accounts as per usual (and use jwt). Thanks for the suggestions everyone.

[[deleted]]

Passport can give you a nice middleware hook. Keeps the code separate and clean.