# express-bearer-token

> Bearer token middleware for express.

Latest version **3.0.0** (published 2024-11-11) · 0 weekly downloads

## Install

```sh
npm install express-bearer-token
pnpm add express-bearer-token
yarn add express-bearer-token
bun add express-bearer-token
```

## Health

**Score 35/100 (D)** — status: maintenance-mode.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: stale; low maintenance score.

## Facts

| | |
|---|---|
| Version | 3.0.0 |
| Published | 2024-11-11 |
| First published | 2014-10-01 |
| Weekly downloads | 0 |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >= 6.0.0 |
| Dependencies | 2 |
| Unpacked size | 13.1 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 81 |
| Maintainers | moshe, tkellen, boutell, madhums, dimensi, mkormendy, jjdbrinker |
| Keywords | bearer token, bearer token middleware, express token, authorization bearer |

## Links

- npm: https://www.npmjs.com/package/express-bearer-token
- Repository: https://github.com/tkellen/node-express-bearer-token
- Issues: https://github.com/tkellen/node-express-bearer-token/issues
- npm.io page: https://npm.io/package/express-bearer-token

## Dependencies (2)

- [cookie](https://npm.io/package/cookie.md) ^1.0.1
- [cookie-parser](https://npm.io/package/cookie-parser.md) ^1.4.4

## Alternatives

- [@sindresorhus/slugify](https://npm.io/package/@sindresorhus/slugify.md) — 3.7M weekly downloads
- [solid-js](https://npm.io/package/solid-js.md) — 2.7M weekly downloads
- [expo-glass-effect](https://npm.io/package/expo-glass-effect.md) — 2.5M weekly downloads
- [nanoassert](https://npm.io/package/nanoassert.md) — 780.8K weekly downloads
- [@ffmpeg/ffmpeg](https://npm.io/package/@ffmpeg/ffmpeg.md) — 529.5K weekly downloads

## Recent versions

- 3.0.0 (latest) — 2024-11-11
- 2.4.0 — 2019-04-06
- 2.3.0 — 2019-04-06
- 2.2.0 — 2018-07-22
- 2.1.1 — 2017-12-06
- 2.1.0 — 2015-01-21
- 2.0.1 — 2014-11-13
- 2.0.0 — 2014-10-01
- 1.0.1 — 2014-10-01
- 1.0.0 — 2014-10-01

## README

# express-bearer-token [![Build Status](https://secure.travis-ci.org/tkellen/js-express-bearer-token.png)](http://travis-ci.org/tkellen/js-express-bearer-token)
> Bearer token middleware for express.

[![NPM](https://nodei.co/npm/express-bearer-token.png)](https://nodei.co/npm/express-bearer-token/)

## What?

Per [RFC6750] this module will attempt to extract a bearer token from a request from these locations:

* The key `access_token` in the request body.
* The key `access_token` in the request params.
* The value from the header `Authorization: Bearer <token>`.
* (Optional) Get a token from cookies header with key `access_token`.

If a token is found, it will be stored on `req.token`.  If one has been provided in more than one location, this will abort the request immediately by sending code 400 (per [RFC6750]).

```js
const express = require('express');
const bearerToken = require('express-bearer-token');
const app = express();

app.use(bearerToken());
app.use(function (req, res) {
  res.send('Token '+req.token);
});
app.listen(8000);
```

For APIs which are not compliant with [RFC6750], the key for the token in each location is customizable, as is the key the token is bound to on the request (default configuration shown):
```js
app.use(bearerToken({
  bodyKey: 'access_token',
  queryKey: 'access_token',
  headerKey: 'Bearer',
  reqKey: 'token',
  cookie: false, // by default is disabled
}));
```

Get token from cookie key (it can be signed or not)

**Warning**: by __NOT__ passing `{signed: true}` you are accepting a non signed cookie and an attacker might spoof the cookies. so keep in mind to use signed cookies
```js
app.use(bearerToken({
  cookie: {
    signed: true, // if passed true you must pass secret otherwise will throw error
    secret: 'YOUR_APP_SECRET',
    key: 'access_token' // default value
  }
}));

```

As of version 2.2.0 we've added initial support for TypeScript. 

[RFC6750]: https://tools.ietf.org/html/rfc6750

---
_Source: https://npm.io/package/express-bearer-token · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._