# http-auth

> Node.js package for HTTP basic and digest access authentication.

Latest version **4.2.1** (published 2025-05-02) · MIT license · 0 weekly downloads

## Install

```sh
npm install http-auth
pnpm add http-auth
yarn add http-auth
bun add http-auth
```

## Health

**Score 43/100 (D)** — status: stable.

Positive: has types package; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: stale.

## Facts

| | |
|---|---|
| Version | 4.2.1 |
| Published | 2025-05-02 |
| First published | 2011-09-18 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/http-auth) |
| Module format | CommonJS |
| Node | >=8 |
| Dependencies | 4 |
| Unpacked size | 17.4 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 369 |
| Author | Gevorg Harutyunyan |
| Maintainers | gevorg |
| Keywords | http, basic, digest, access, authentication |

## Links

- npm: https://www.npmjs.com/package/http-auth
- Repository: https://github.com/gevorg/http-auth
- Issues: http://github.com/gevorg/http-auth/issues
- npm.io page: https://npm.io/package/http-auth

## Dependencies (4)

- [uuid](https://npm.io/package/uuid.md) >=8.3.2 <12
- [bcryptjs](https://npm.io/package/bcryptjs.md) ^2.4.3 || ^3.0.0
- [apache-md5](https://npm.io/package/apache-md5.md) ^1.0.6
- [apache-crypt](https://npm.io/package/apache-crypt.md) ^1.1.2

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads

## Recent versions

- 4.2.1 (latest) — 2025-05-02
- 4.2.0 — 2022-09-21
- 4.1.9 — 2021-08-10
- 4.1.7 — 2021-06-24
- 4.1.6 — 2021-06-24
- 4.1.5 — 2021-04-09
- 4.1.4 — 2021-03-17
- 4.1.3 — 2021-03-14
- 4.1.2 — 2020-02-03
- 4.1.1 — 2020-02-02
- 4.1.0 — 2020-02-02
- 4.0.2 — 2020-02-02
- 4.0.1 — 2020-02-02
- 4.0.0 — 2020-02-02
- 3.2.4 — 2019-10-02
- … 90 more at https://npm.io/package/http-auth/versions

## README

# http-auth
[Node.js](http://nodejs.org/) package for HTTP basic and digest access authentication.

[![build](https://github.com/gevorg/http-auth/workflows/build/badge.svg)](https://github.com/gevorg/http-auth/actions/workflows/build.yml)

## Installation

Via git (or downloaded tarball):

```bash
$ git clone git@github.com:gevorg/http-auth.git
```
Via [npm](http://npmjs.org/):

```bash
$ npm install http-auth
```    

## Usage

```javascript
// HTTP module
const http = require("http");

// Authentication module.
const auth = require("http-auth");
const basic = auth.basic({
  realm: "Simon Area.",
  file: __dirname + "/../data/users.htpasswd" // gevorg:gpass, Sarah:testpass
});

// Creating new HTTP server.
http
  .createServer(
    basic.check((req, res) => {
      res.end(`Welcome to private area - ${req.user}!`);
    })
  )
  .listen(1337, () => {
    // Log URL.
    console.log("Server running at http://127.0.0.1:1337/");
  });
```

Please check [examples directory](./examples) for more.

## Configurations

 - `realm` - Authentication realm, by default it is **Users**.
 - `file` - File where user details are stored.
     - Line format is **{user:pass}** or **{user:passHash}** for basic access. 
     - Line format is **{user:realm:passHash}** for digest access.
     - Using a callback, it needs to return the same line format, example: `file: () => 'adam:adam\neve:eve',`
 - `algorithm` - Algorithm that will be used only for **digest** access authentication.
     - **MD5** by default.
     - **MD5-sess** can be set.
 - `qop` - Quality of protection that is used only for **digest** access authentication.
     - **auth** is set by default.
     - **none** this option is disabling protection.
 - `msg401` - Message for failed authentication 401 page.
 - `msg407` - Message for failed authentication 407 page.
 - `contentType` - Content type for failed authentication page.
 - `skipUser` - Set this to **true**, if you don't want req.user to be filled with authentication info.
 - `proxy` - Set this to **true**, if you want to use it with [http-proxy](https://github.com/http-party/node-http-proxy).

## Running tests

It uses [mocha](https://mochajs.org/), so just run following command in package directory:

```bash
$ npm test
```

## Questions

You can also use [stackoverflow](http://stackoverflow.com/questions/tagged/http-auth) to ask questions using **[http-auth](http://stackoverflow.com/tags/http-auth/info)** tag.

## Utilities

 - **[htpasswd](https://github.com/gevorg/htpasswd/)** - Node.js package for HTTP Basic Authentication password file utility.
 - **[htdigest](https://github.com/gevorg/htdigest/)** - Node.js package for HTTP Digest Authentication password file utility.

## Integrations

Please check [this link](https://github.com/http-auth) for integration packages.

## License

The MIT License (MIT)

---
_Source: https://npm.io/package/http-auth · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._