# whowho > Authenticating reverse-proxy for writing simpler apps Latest version **0.0.4** (published 2014-08-08) · BSD-3-Clause license · 0 weekly downloads ## Install ```sh npm install whowho pnpm add whowho yarn add whowho bun add whowho ``` ## Health **Score 15/100 (F)** — status: abandoned. Positive: no vulnerabilities. Warnings: low downloads; no types; no esm support; pre 1.0. Negative: abandoned; low maintenance score. ## Facts | | | |---|---| | Version | 0.0.4 | | Published | 2014-08-08 | | First published | 2014-08-08 | | Weekly downloads | 0 | | License | BSD-3-Clause | | TypeScript types | none | | Module format | CommonJS | | Dependencies | 12 | | Known vulnerabilities | 0 (+14 in 6 direct dependencies) | | Install scripts | no | | Author | Ryan Muller | | Maintainers | baconscript | | Keywords | authentication, proxy, reverse proxy | ## Links - npm: https://www.npmjs.com/package/whowho - Repository: https://github.com/baconscript/whowho - Issues: https://github.com/baconscript/whowho/issues - npm.io page: https://npm.io/package/whowho ## Dependencies (12) - [jade](https://npm.io/package/jade.md) ~1.3.0 - [debug](https://npm.io/package/debug.md) ~0.7.4 - [lodash](https://npm.io/package/lodash.md) ^2.4.1 - [morgan](https://npm.io/package/morgan.md) ~1.0.0 - [express](https://npm.io/package/express.md) ~4.2.0 - [passport](https://npm.io/package/passport.md) ~0.2.0 - [http-proxy](https://npm.io/package/http-proxy.md) ^1.2.0 - [body-parser](https://npm.io/package/body-parser.md) ~1.0.0 - [cookie-parser](https://npm.io/package/cookie-parser.md) ~1.0.1 - [passport-local](https://npm.io/package/passport-local.md) ~1.0.0 - [static-favicon](https://npm.io/package/static-favicon.md) ~1.0.0 - [express-session](https://npm.io/package/express-session.md) ~1.7.4 ## Alternatives - [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads - [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads - [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads - [@oxyhq/services](https://npm.io/package/@oxyhq/services.md) — 2.3K weekly downloads - [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads ## Recent versions - 0.0.4 (latest) — 2014-08-08 - 0.0.3 — 2014-08-08 - 0.0.2 — 2014-08-08 - 0.0.1 — 2014-08-08 ## README # whowho A simple authenticating proxy for your apps. ## Installation ``` npm install --save whowho ``` ## Configuration There are four items that need to be in place for your app to work correctly, all of which can be found in the configuration object passed to the constructor: ### targets This is a hash of paths and hosts/ports that you want to proxy to. For instance: ``` targets: { '/*': 'http://localhost:8000' } ``` This will proxy to an app running on the same machine on port 8000. If your proxy is only proxying one page, make sure you haven't forgotten the asterisk on the path. Otherwise, it will literally only match the `/` path. If you need to, you can also specify `publicTargets` which won't be authenticated, e.g. for assets. However, in production, I encourage you to use nginx or another static server for assets. ### strategies These are normal [PassportJS](http://passportjs.com) strategies, tied to their name. The various strategies need to be `require`d from their packages, such as `var LocalStrategy = require('passport-local').Strategy;`. You can then write the following: ``` strategies: { local: new LocalStrategy( function(username, password, done) { if(username === 'admin' && password === 'admin') { return done(null, { id:1, name:{ givenName:'Admin', familyName:'Root'} }); } else { return done(null, false, { message: 'Wrong username or password.' }); } }) } ``` This represents a simple authentication for username `admin` and password `admin`. ### auth This represents how you want to authentiate to WhoWho. For instance, to continue the above example: ``` auth: { 'post /login': function(passport){ return passport.authenticate('local', { successRedirect: '/', failureRedirect: '/login' }); } } ``` ### serializeUser/deserializeUser Okay, I'm cheating; these are two functions, not one. This is for your caching layer. For this example, we'll cheat, and do it in memory. This is a Bad IdeaTM for a few reasons, but I don't want to muddle the example with Redis calls or similar. Suppose that before creating the proxy, you had created a `users` hash: ``` var users = {}; ``` Then, in your WhoWho config, you could simply use: ``` serializeUser: function(user, done){ users[user.id] = user; done(null, user.id); }, deserializeUser: function(id, done){ done(null, users[id]); } ``` ## Sample config Putting the above all together in a full example, you'd get: ``` var passport = require('passport'); var AuthProxy = require('whowho').AuthProxy; var LocalStrategy = require('passport-local').Strategy; var users = {}; var proxyServer = new AuthProxy({ strategies: { local: new LocalStrategy( function(username, password, done) { if(username === 'admin' && password === 'admin') { return done(null, { id:1, name:{ givenName:'Admin', familyName:'Root'} }); } else { return done(null, false, { message: 'Wrong username or password.' }); } }) }, auth: { 'post /login': function(passport){ return passport.authenticate('local', { successRedirect: '/', failureRedirect: '/login' }); } }, targets: { '/*': 'http://localhost:8000' }, serializeUser: function(user, done){ users[user.id] = user; done(null, user.id); }, deserializeUser: function(id, done){ done(null, users[id]); } }); proxyServer.start(); ``` This simple script will run on the default port (3000) and proxy authenticated users through to the app running on port 8000. Unauthenticated users will see a "403 Forbidden" message. --- _Source: https://npm.io/package/whowho · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._