Learn using JWT with Passport authentication
Tags: javascript, jwt, authentication, passport
Published: 2018-01-24 10:49:18

---
title: "Learn using JWT with Passport authentication"
published: true
tags: javascript,jwt,authentication,passport
canonical_url: 
---

![](https://cdn-images-1.medium.com/max/800/1*QTeLq8g_qQ-IL8ry7pBwrg.jpeg)

### Introduction

Almost every web and mobile app nowadays have _authentication_. Most of them offer different login methods like Facebook, Google or email/password at&nbsp;once.

[Passport](http://www.passportjs.org/) is a Node.js middleware that offers a variety of different request authentication strategies that are easy to implement. By default, it stores the user object in&nbsp;session.

[JSON Web Tokens](https://jwt.io/) is an authentication standard that works by assigning and passing around an encrypted token in requests that helps to identify the logged in user, instead of storing the user in a session on the server and creating a cookie. It has different integrations including a [Node.js&nbsp;module](https://github.com/auth0/node-jsonwebtoken).

Below is a tutorial about using this two modules together and setting up an authentication on an express based backend. Luckily, **Passport** allows an option to store the user object _in request_ instead of the&nbsp;session.

The tutorial will use a simple local (email/password) authentication, but it may as well be used with any other strategy.

First, let's install the dependencies.

```bash
npm install --save passport passport-local passport-jwt jsonwebtoken
```

Now here is how everything is going to&nbsp;work:

- When the user logs in, the backend creates a signed token and returns it in&nbsp;response
- The client saves the token locally (typically in **localStorage** ) and sends it back in every subsequent request that needs authentication
- All requests needing authentication pass through a middleware that checks the provided token and allows the request only if the token is&nbsp;verified

So, let’s implement this&nbsp;logic.

### Login

Assume we have set up and used the local passport strategy in a separate file next to **_app.js_** like&nbsp;this:

```javascript
//passport.js

const passport = require('passport');
const LocalStrategy = require('passport-local').Strategy;

passport.use(new LocalStrategy({
        usernameField: 'email',
        passwordField: 'password'
    }, 
    function (email, password, cb) {

//this one is typically a DB call. Assume that the returned user object is pre-formatted and ready for storing in JWT

return UserModel.findOne({email, password})
           .then(user => {
               if (!user) {
                   return cb(null, false, {message: 'Incorrect email or password.'});
               }

return cb(null, user, {message: 'Logged In Successfully'});
          })
          .catch(err => cb(err));
    }
));
```

We need to require this file in&nbsp; **_app.js._**

```javascript
//app.js

const express = require('express');
...
require('./passport');

const app = express();
...
const auth = require('./routes/auth');
app.use('/auth', auth);
```

Now, in our **_auth.js_** route file, we’ll implement the login action. Here, we call the passport authentication function with local strategy, handle the errors and log in the&nbsp;user.

```javascript
//routes/auth.js

const express = require('express');
const router = express.Router();
const jwt = require('jsonwebtoken');
const passport = require("passport”);

/* POST login. */
router.post('/login', function (req, res, next) {

passport.authenticate('local', {session: false}, (err, user, info) => {
        if (err || !user) {
            return res.status(400).json({
                message: 'Something is not right',
                user : user
            });
        }

req.login(user, {session: false}, (err) => {
           if (err) {
               res.send(err);
           }

// generate a signed son web token with the contents of user object and return it in the response

const token = jwt.sign(user, 'your_jwt_secret');
           return res.json({user, token});
        });
    })(req, res);
});
```

Note, that we pass **{session: false}** in passport options so that it won't save the user in the session. Also, we create and return a _signed JSON web token_ based on the user object to the client. You can, of course, choose any object to create a token with, as long as it will help you identify your user. The idea is, to store the minimum info that you can use without having to retrieve the user from the database in all the authenticated requests.

### Protected requests

Now, we’ll create a middleware, that allows only requests with valid tokens to access some special routes needing authentication, eg. _/user/profile._ For this, we will use the **_passport-jwt_** strategy. We’ll add it in our **_passport.js_** file.

```javascript
//passport.js

...
const passportJWT = require("passport-jwt");
const JWTStrategy = passportJWT.Strategy;
const ExtractJWT = passportJWT.ExtractJwt;
...

passport.use(new JWTStrategy({
        jwtFromRequest: ExtractJWT.fromAuthHeaderAsBearerToken(),
        secretOrKey : 'your_jwt_secret'
    },
    function (jwtPayload, cb) {

        //find the user in db if needed. This functionality may be omitted if you store everything you'll need in JWT payload.
        return UserModel.findOneById(jwtPayload.id)
            .then(user => {
                return cb(null, user);
            })
            .catch(err => {
                return cb(err);
            });
    }
));
```

Note, that we assume that the client will send the JWT token in **Authorization Header as a Bearer Token.** The Passport JWT Strategy [supports many other ways](https://github.com/themikenicholson/passport-jwt) of getting the token from requests. Choose whichever suits your&nbsp;needs.

Now, all we need to do is to use this middleware in our app for the protected routes. For this tutorial, we’ll prepare a simple user route like&nbsp;this:

```javascript
//routes/user.js

const express = require('express');
const router = express.Router();

/* GET users listing. */
router.get('/', function(req, res, next) {
  res.send('respond with a resource');
});

/* GET user profile. */
router.get('/profile', function(req, res, next) {
    res.send(req.user);
});

module.exports = router;
```

And use the passport authentication middleware on user route as shown&nbsp;below:

```javascript
//app.js

const express = require('express');
...
require('./passport');

const app = express();
...
const auth = require('./routes/auth');
const user = require('./routes/user');

app.use('/auth', auth);
app.use('/user', passport.authenticate('jwt', {session: false}), user);
```

And that’s&nbsp;it!

Go on and try out some requests, now they’ll be backed with JSON Web Token authorization with Passport&nbsp;👍


* * *