# koa-bearer-token

> Bearer token parser middleware for koa

Latest version **2.0.2** (published 2021-08-30) · MIT license · 0 weekly downloads

## Install

```sh
npm install koa-bearer-token
pnpm add koa-bearer-token
yarn add koa-bearer-token
bun add koa-bearer-token
```

## Health

**Score 25/100 (F)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.0.2 |
| Published | 2021-08-30 |
| First published | 2015-04-25 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >=12 |
| Dependencies | 2 |
| Unpacked size | 10.4 KB |
| Known vulnerabilities | 0 (+1 in 1 direct dependencies) |
| Install scripts | no |
| GitHub stars | 34 |
| Author | C. T. Lin |
| Maintainers | chentsulin |
| Keywords | bearer, koa, middleware, oauth, token |

## Links

- npm: https://www.npmjs.com/package/koa-bearer-token
- Repository: https://github.com/chentsulin/koa-bearer-token
- Issues: https://github.com/chentsulin/koa-bearer-token/issues
- npm.io page: https://npm.io/package/koa-bearer-token

## Dependencies (2)

- [cookie](https://npm.io/package/cookie.md) ^0.4.1
- [cookie-parser](https://npm.io/package/cookie-parser.md) ^1.4.5

## Recent versions

- 2.0.2 (latest) — 2021-08-30
- 2.0.1 — 2021-08-21
- 2.0.0 — 2021-08-21
- 1.0.0 — 2018-04-19
- 0.1.2 — 2015-04-27
- 0.1.1 — 2015-04-26
- 0.1.0 — 2015-04-25

## README

# koa-bearer-token

[![npm version](https://badge.fury.io/js/koa-bearer-token.svg)](https://npmjs.org/package/koa-bearer-token)
[![Build Status](https://github.com/chentsulin/koa-bearer-token/workflows/CI/badge.svg?branch=master)](https://github.com/chentsulin/koa-bearer-token/actions?query=branch%3Amaster)
[![Coverage Status](https://coveralls.io/repos/github/chentsulin/koa-bearer-token/badge.svg?branch=master)](https://coveralls.io/r/chentsulin/koa-bearer-token?branch=master)

> Bearer token parser middleware for koa

Inspired by [express-bearer-token](https://www.npmjs.com/package/express-bearer-token)

## Installation

```sh
$ npm install koa-bearer-token
```

## What?

Per [RFC6750](https://datatracker.ietf.org/doc/html/rfc6750) this module will attempt to extract a bearer token from a request from these locations:

- The key `access_token` in the request body.
- The key `access_token` in the request query params.
- The value from the header `Authorization: Bearer <token>`.
- (Optional) Get a token from cookies header with key `access_token`.

If a token is found, it will be stored on `ctx.request.token`. If one has been provided in more than one location, this will abort the request immediately by sending code 400 (per [RFC6750]).

```js
const Koa = require('koa');
const bodyParser = require('koa-bodyparser');
const { bearerToken } = require('koa-bearer-token');

const app = new Koa();

app.use(bodyParser());
app.use(bearerToken());

app.use((ctx) => {
  // ctx.request.token
});

app.listen(3000);
```

For APIs which are not compliant with [RFC6750], the key for the token in each location is customizable, as is the key the token is bound to on the request (default configuration shown):

```js
app.use(
  bearerToken({
    bodyKey: 'access_token',
    queryKey: 'access_token',
    headerKey: 'Bearer',
    reqKey: 'token',
  }),
);
```

Get token from cookie key (it can be signed or not)

**Warning**: by **NOT** passing `{ signed: true }` you are accepting a non signed cookie and an attacker might spoof the cookies. so keep in mind to use signed cookies

```js
app.use(
  bearerToken({
    cookie: {
      signed: true, // if passed true you must pass secret otherwise will throw error
      secret: 'YOUR_APP_SECRET',
      key: 'access_token', // default value
    },
  }),
);
```

## TypeScript

As of version 2.0.1 we've added initial support for TypeScript.

If you're using your custom `reqKey`, you must do [module augmentation](https://www.typescriptlang.org/docs/handbook/declaration-merging.html#module-augmentation) on your own:

```ts
declare module 'koa' {
  interface Request {
    myToken?: string;
  }
}

app.use(
  bearerToken({
    reqKey: 'myToken',
  }),
);
```

## Compatibility table

| koa version | koa-bearer-token version |
| :---------: | :----------------------: |
|    `<2`     |         `0.x.x`          |
|     `2`     |        `>=1.x.x`         |

## License

MIT © [C. T. Lin](https://github.com/chentsulin)

---
_Source: https://npm.io/package/koa-bearer-token · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._