ciphertoken v0.9.5

--WORK IN PROGRESS--

cipherToken

A method to create ciphered accessToken based on the following principles:

• must include id information.
• must include expiration information.
• must be a designed token to transport, but not to store it.

NodeJS

Require

var cipherToken = require('cipherToken');

Usage

cipherToken is designed to be used as a module.

Tokens are created this way

cipherToken.createToken(settings, user_id, session_id, data, function(err, token){});

and can be decoded back to a more readable state with

cipherToken.getTokenSet(settings, token, function(err, tokenSet){});

Settings

Settings is a hash with the following properties

• cipherKey : (required) used to cipher the accessToken
• firmKey : (required) used to firm the accessToken
• tokenExpirationMinutes : minutes of accessToken life (90 minutes by default)
• cipherAlgorithm : algorithm used to cipher the token (aes-256-cbc by default)
• hmacAlgorithm : algorithm used to build the hmac (md5 by default)
• hmacDigestEncoding : encoding used in the outbound of the hmac digest (hex by default)
• plainEncoding : encoding used in the data content in the token (utf8 by default)
• tokenEncoding : encoding used in the token format (base64 by default)
• enableSessionId : sessionId of an accessToken, can be preset at accessToken creation

Settings must be passed to cipherToken in each call. Only cipherKey and firmKey are required.

Method: createToken

cipherToken.createToken(settings, user_id, session_id, data, function(err, token){});

To create a token the first thing you need to do is to define your settings. UserId can be an username or any other thing you use to identify your clients. SessionId is only when you want to create a token associated to the same session of another token (usually near expiration). SessionId can be null. Data is to encode the payload you want to travel with the token.

cipherToken.createToken expects a callback in the error-result form.

Method: getTokenSet

cipherToken.getTokenSet(settings, token, function(err, tokenSet){});

Same settings of creation must be provided in order to decode the token.

tokenSet has the following properties

• userId: the same as the provided one
• expiresAtTimestamp: at creation, gets the actual time and add to it the time expiration to calculate when will the token expire. Cipher token doesn't care if the token has expired or not.
• data: same as provided
• sessionId: (if enabled) random the first time, after that previous one can be used

Example

var cipherToken = require('cipherToken');

var settings = {
    cipherKey: 'myCipherKey123',
    firmKey:  'myFirmKey123'
};

var userId = 'John Spartan';
var data = 'validData';

cipherToken.createToken(settings, userId, null, data, doWhateverYouWantWithYourToken);
function doWhateverYouWantWithYourToken(err, token){

}

cipherToken.getTokenSet(settings, validToken, function(err, tokenSet){
    console.log(tokenSet.userId);
    console.log(tokenSet.data);
    console.log(tokenSet.expiresAtTimestamp);
});