# barillet

> A Connect middleware handling 1 factor TOTP authentication.

Latest version **0.0.4** (published 2014-06-29) · MIT license · 0 weekly downloads

## Install

```sh
npm install barillet
pnpm add barillet
yarn add barillet
bun add barillet
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.0.4 |
| Published | 2014-06-29 |
| First published | 2014-05-16 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=0.10.25 |
| Dependencies | 4 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | Maxime Walzberg |
| Maintainers | nucky |
| Keywords | mongodb, connect, middleware, authentification, totp |

## Links

- npm: https://www.npmjs.com/package/barillet
- Repository: http://github.com/mwalzberg/barillet
- npm.io page: https://npm.io/package/barillet

## Dependencies (4)

- [gotp](https://npm.io/package/gotp.md) >=1.0.0
- [async](https://npm.io/package/async.md) >=0.9.0
- [mongodb](https://npm.io/package/mongodb.md) >=1.4.4
- [validator](https://npm.io/package/validator.md) >=3.12.0

## Alternatives

- [angular-pipes](https://npm.io/package/angular-pipes.md) — 5.6K weekly downloads
- [@ng-web-apis/midi](https://npm.io/package/@ng-web-apis/midi.md) — 2.6K weekly downloads
- [happn-3](https://npm.io/package/happn-3.md) — 1.6K weekly downloads
- [@opensip-cli/lang-go](https://npm.io/package/@opensip-cli/lang-go.md) — 1.2K weekly downloads
- [mongoose-typescript](https://npm.io/package/mongoose-typescript.md) — 85 weekly downloads

## Recent versions

- 0.0.4 (latest) — 2014-06-29
- 0.0.3 — 2014-05-18
- 0.0.2 — 2014-05-18
- 0.0.1 — 2014-05-16

## README

# Barillet connect middleware

One factor TOTP authentication middleware for connect / express.

## Goals
Barillet aims to be a super safe and secure authentication system, at the cost of being super-weary for human users.

Barillet

- Doesn't trust or rely on HTTPS
- Avoid sending sensitive data over the net (like a password, a session ID, or even an username) that could be reused by an attacker
- Avoid any human error by not using password

It's not :

- Meant for systems with a lot of users. Barillet calculates each user's token at each authentication (see Security, Token Interception).
- Meant to provide sessions
- Meant to authenticate a server to the client (see Security, MITM)
- Meant to sign a request's body (see Security, MITM again)

## Usage

    barillet = require("barillet")
    app.use(barillet(db))

Where DB can be either a mongodb URL, a mongo.Db instance (obtained via mongo.MongoClient.connect) or an objects containing two mongo.Collection : `users` and `bans`.

## Security

### Validation
String that doesnt length 6 characters or that are not integers throw 400-Bad Request.

### Multiple users have the same token
If anytime multiple users have the same token, Barillet will apologize throwing a 500-Internal Error. If that ever occurs.

### Token interception
If an attacker sniff's and gets a token, he won't be able to use it. Tokens can only be used once. Therefore, even valid users need to wait minimum 30 seconds between two authenticated actions.

### Bruteforce attacks
Once a client's IP failed to send a valid token, any other attempts from this IP will throw a 429-Too Many Requests, until next time slice.

### Man In The Middle attacks
Barillet doesn't prevent Man-in-the-Middle attacks. It doesnt authenticate the server toward the client. One can pretend to be the server and use a token to send an altered request to your actual app. Or respond with altered informations.

This may be done with HTTPS, if you do trust Certificate Authorities.

---
_Source: https://npm.io/package/barillet · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._