Last week, in the article "Creating a Node.js HTTP Server", I introduced the basics of HTTP in Node.js. Today's article will show you how to use HTTP authentication to protect your Node.js site from password attacks. We will first introduce basic access authentication and then move to more secure digest access authentication.

Key Points

• Basic access authentication and digest access authentication are two HTTP authentication methods in Node.js. Basic access authentication is simpler and prompts the user for a username and password, while Digest access authentication is more secure because it encrypts the password before transmission.
• Node.js utility htpasswd is used to manage password files in basic access authentication, while htdigest utility is used to digest access authentication. Passwords are stored in the password file on the server side, and the http-auth module is used to add authentication support to the HTTP server.
• Using HTTP authentication alone is not enough to ensure the security of your Node.js application. For better security, it should be served via HTTPS. Express.js can be used to implement HTTP authentication in Node.js and use the express-basic-auth middleware.

Basic Access Authentication

When a user accesses a site that implements authentication, the system will prompt him/her to enter his/her username and password. If the user provides valid credentials, they will be taken to the content of the page, otherwise they will be denied with a "401 Unauthorized" response. The easiest type of HTTP authentication is basic access authentication.

Password file

On the server side, all usernames and encrypted passwords are stored in the password file. Node.js utility htpasswd can be used to manage password files. To install htpasswd, use the following command. npm stands for the Node.js package manager, which is installed by default with Node.js. npm Used to install the Node.js module. -g flags the global installation package, which means it is included in the system's PATH variable.

npm install -g htpasswd

After installing htpasswd, you can create a new user using the following command. This example uses the -c flag to create a new password file named "htpasswd". In the new file, add a user named "foo". The -b flag allows the password "bar" to be specified as part of the command line.

htpasswd -bc htpasswd foo bar

After running the command, open your "htpasswd" file. The password file entry for user "foo" is shown below. This line contains the username and encrypted password. Since this is the first and only user in the file, this should be the only line in the file.

<code>foo:{SHA}Ys23Ag/5IOWqZCw9QGaVDdHwH00=</code>

Node.js integration

The next step is to add authentication support to our HTTP server. First, you need to install the http-auth module using the following npm command.

npm install -g htpasswd

Next, create a new file called "basic_auth_server.js" and add the following code. Note that the http-auth module is referenced in line 2. In lines 3 to 7, pass the configuration object to the authentication module. The authRealm field defines the authentication realm. The authFile field points to the password file we created earlier. __dirname refers to the directory where the script currently being executed is located. This example assumes that the "htpasswd" file is in the same directory as "basic_auth_server.js". The authType Configuration field indicates the type of authentication to use. In line 9, the basic authentication scheme is applied to the HTTP connection. The authentication callback function provides an authenticated username for further processing.

htpasswd -bc htpasswd foo bar

Finally, start the server. You can connect to the server by navigating to http://ipnx.cn/link/bb122c8fe6c764e8aae555e2186a6344. You will be prompted to enter your username and password. Provide the credentials you created earlier and the browser will say hello to you by name.

Limitations

The biggest disadvantage of basic access authentication is that the credentials are sent over the network as plain text. To prevent eavesdropping, such authentication can only be used with secure (i.e. HTTPS) connections. If a secure connection is not available, you should use a more secure form of authentication instead.

Dissue Access Authentication

Digital access authentication is a more secure alternative to basic authentication. With Digest Authentication, the password is encrypted before the network is transmitted.

Password file

Digit authentication also uses password files. However, the file format is slightly different from the one used in Basic Authentication. To use the digest password file format, we will use a different utility called htdigest. Use the following npm command to install htdigest.

<code>foo:{SHA}Ys23Ag/5IOWqZCw9QGaVDdHwH00=</code>

Next, use the following command to create a new password file. Similarly, the -c flag is used to create a new password file named "htpasswd". This time we also have to specify an authentication field. In this case, the authentication field is "Private area". In this example, the username is again "foo". Please note that the password is not provided in the command. After entering the command, you will be prompted to provide your password.

npm install http-auth

After running htdigest, check the inside of the new "htpasswd" file. The entry for "foo" is shown below. The digest authentication file contains the username and encrypted password, as well as the authentication realm not included in the basic authentication file.

npm install -g htpasswd

Node.js integration

To integrate digest authentication into our server, we will use the http-auth module again. If you have been following this tutorial, the module should already be installed on your machine. Next, create a new file called "digest_auth_server.js" to implement your server. The server code is shown below. Note that the server code is almost the same as the basic authentication server code. The difference is the authType field of the configuration object. In this case, authType is set to "digest". This server can be accessed like a basic authentication server.

htpasswd -bc htpasswd foo bar

Conclusion

This article introduces the basics of HTTP authentication. By following the examples provided here, your Node.js application can be a little safer. However, you should know that authentication alone is not enough. If security is the main issue, your site should be served via HTTPS. In a future post, I will explore HTTPS and many other great Node.js features. If you liked this post, you will want to know everything about SitePoint’s latest collection of print and e-book Jump Start. The first book is Don Nguyen's "Node.js" - Learn more at SitePoint!

(The following is the FAQ part. Due to the length of the article, I will summarize the FAQ part to retain core information and avoid duplication and redundancy.)

FAQ (FAQ) About HTTP Authentication in Node.js

• How to implement HTTP authentication using Express.js in Node.js? Use express-basic-auth Middleware. The sample code shows how to authenticate with a username and password.

• How to protect my Node.js application using HTTP authentication? Use the http-auth module and specify the password file path. Be sure to use HTTPS to improve security.

• How to use HTTP authentication to handle multiple users? Use a file or database to store username and password. The http-auth module supports this function.

• How to customize HTTP authentication prompts in Node.js? Set the realm option.

• How to deal with authentication failure in Node.js? The server will send a 401 unauthorized response. You can customize this response.

• How to use HTTP authentication with HTTPS? Create an HTTPS server instead of an HTTP server.

• How to use HTTP authentication with cookies? Set cookies after successful authentication.

• How to use HTTP authentication with a session? Use session middleware, such as express-session.

• How to use HTTP authentication with JSON Web Token (JWT)? Use JWT middleware, for example express-jwt.

• How to use HTTP authentication with OAuth? Use OAuth middleware, for example passport.

In short, the above briefly summarizes the core content of the FAQ part and performs pseudo-original processing on the original text. All image links are left unchanged.

The above is the detailed content of HTTP Authentication in Node.js. For more information, please follow other related articles on the PHP Chinese website!