Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
var TwitterStrategy = require('passport-twitter').Strategy;
var errors = require('feathers-errors');
var feathers = require('feathers');
var passport = require('passport');
// var promisify = require('es6-promisify');
var session = require('express-session');
var RedisStore = require('connect-redis')(session);
var config = require('../integrations/config');
var integrations = require('../integrations');
var redis = require('./redis');
var CHROMIUM_IDS = process.env.CHROMIUM_IDS.split(';');
// HACK This only applied to twitter
passport.use(new TwitterStrategy({
consumerKey: process.env.TWITTER_CONSUMER_KEY,
consumerSecret: process.env.TWITTER_CONSUMER_SECRET,
callbackURL: '/v2/twitter/callback'
}, function(token, tokenSecret, profile, callback) {
redis.set('auth:twitter:' + token, tokenSecret, _.partial(callback, _, token));
}));
module.exports = feathers.Router()
.use(session({
store: new RedisStore({ client: redis }),
secret: (process.env.SECURE_KEY || '').split(','),
saveUninitialized: false,
resave: false
}))
.use(passport.initialize())
.use(passport.session())
module.exports = (app)=>{
passport.use(new LocalStrategy(
(username,password,done)=>{
console.log('querying db')
app.db.queryUser({
username
})
.then(user=>{
/* never use md5 to store passwords*/
// done(null, user ?
// user.password === md5(password) ?
// user :
// false :
// false)
/* bcrypt -> more secure */
bcrypt.compare(password,user.passhash)
// Support JSON encoded bodies.
app.use(bodyParser.json());
// Support encoded bodies.
app.use(bodyParser.urlencoded({extended: true}));
// Support gzip and deflate.
app.use(compression());
app.use(passport.initialize());
app.use(passport.session());
passport.serializeUser((user, done) => {
done(null, user);
});
passport.use(new LocalStrategy((username, password, done) => {
const account = AccountsManager.getAccountByUsername(username);
if (!account) {
console.log(TAG, 'Login ' + username + ': account not found.');
return done(null, false);
}
account.isCorrectPassword(password).then((is_correct) => {
if (!is_correct) {
console.log(TAG, 'Login ' + username + ': incorrect password.');
return done(null, false);
}
// Password is correct.
return done(null, account);
}).catch(() => {
const User = require('../models/User');
passport.serializeUser((user, done) => {
done(null, user.id);
});
passport.deserializeUser((id, done) => {
User.findById(id, (err, user) => {
done(err, user);
});
});
/**
* Sign in with GitHub.
*/
passport.use(new GitHubStrategy({
clientID: process.env.GITHUB_ID,
clientSecret: process.env.GITHUB_SECRET,
callbackURL: '/auth/github/callback',
passReqToCallback: true,
}, (req, accessToken, refreshToken, profile, done) => {
if (req.user) {
if (req.user.hasGitHubScopes(req.session.scopes)) {
return done(null, req.user);
}
// when not all *required* scopes have been granted, we need to
// "reset" user info so that we are sure to use the right token.
req.user.tokens = [{
kind: 'github',
accessToken,
module.exports = function() {
// Use local strategy
passport.use(new LocalStrategy({
usernameField: 'username',
passwordField: 'password'
},
function(username, password, done) {
User.findOne({
username: username
}, function(err, user) {
if (err) {
return done(err);
}
if (!user) {
return done(null, false, {
message: 'Unknown user or invalid password'
});
}
if (!user.authenticate(password)) {
});
passport.deserializeUser((obj, cb) => {
cb(null, obj);
});
// Configure express application to use passportjs
app.use(passport.initialize());
app.use(passport.session());
// Used for AppID - Helmet helps to secure Express apps by setting various HTTP headers
app.use(helmet());
app.use(flash());
// Configure passportjs to use AppID WebAppStrategy
passport.use(new WebAppStrategy(appIDCredentials));
return router;
};
const strategy = new passportJWT.Strategy(jwtOptions, function (jwt_payload, next) {
ApiToken.exists({name: jwt_payload.name})
.then((tokenExists) => {
if (tokenExists)
next(null, jwt_payload);
else
next(null, false);
})
.catch((err) => {
console.log(err);
next(null, false);
})
});
passport.use(strategy);
return passport;
}
const passport = require('passport');
const LocalStrategy = require('passport-local').Strategy;
const ClientPasswordStrategy = require('passport-oauth2-client-password').Strategy;
const BearerStrategy = require('passport-http-bearer').Strategy;
const config = require('../../config');
const jwtPolicy = require('../jwt/jwt');
const services = require('../../services/index');
const authService = services.auth;
require('../basic-auth/registerStrategy')();
passport.use(new LocalStrategy({ passReqToCallback: true }, authenticateLocal));
passport.use(new ClientPasswordStrategy({ passReqToCallback: true }, authenticateBasic));
passport.use(new BearerStrategy({ passReqToCallback: true }, authenticateToken));
passport.serializeUser((user, done) => done(null, user.id));
passport.deserializeUser((id, done) => {
return authService.validateConsumer(id)
.then(consumer => {
if (!consumer) return done(null, false);
return done(null, consumer);
})
.catch(err => done(err));
});
function authenticateToken(req, accessToken, done) {
let endpointScopes;
exports.setup = function (User, config) {
passport.use(new GoogleStrategy({
clientID: config.google.clientID,
clientSecret: config.google.clientSecret,
callbackURL: config.google.callbackURL
},
function (accessToken, refreshToken, profile, done) {
User.findOne({
'google.id': profile.id
}, function (err, user) {
if (!user) {
user = new User({
name: profile.displayName,
email: profile.emails[0].value,
role: 'user',
username: profile.username,
provider: 'google',
google: profile._json
/*
* Sign in using Username and Password.
*/
const users = JSON.parse(fs.readFileSync(
path.join(__dirname, '..', 'model', 'user.json')).toString());
passport.serializeUser((user: User, done) => {
done(undefined, user.username);
});
passport.deserializeUser((username: string, done) => {
done(undefined, Object.assign( {username}, users[username]));
});
passport.use(new LocalStrategy(
{ usernameField: 'username' },
(username: string, password: string, done: Function) => {
if (users[username]) {
if (users[username].password === password) {
return done(undefined,
Object.assign({username}, users[username]));
}
return done(undefined,
false,
{ message: 'Invalid username or password.' });
} else {
return done(undefined,
false,
{ message: `user: ${username} doesn't exist` });
}
}));