Giter Club home page Giter Club logo

verdaccio-static-token's Introduction

verdaccio-static-token

This plugin for Verdaccio npm registry let you to use custom authentication tokens with verdaccio.

DISCALIMER: this is a quick and dirty plugin to archive my needs. You MUST understand how it works because it could be a potential security issue for your registry. The settings of this plugin are not encripted in the verdaccio/config.yaml, so the server must have an access policy.

If you want/need encripted strings in config file send a PR or wait for Verdaccio 4.0.

Installation

npm install verdaccio
npm install verdaccio-static-token

How it works

This plugins is composed of two components:

  • middleware: it modify the authorization header injecting a valid auth token encripted in aes192 using the Verdaccio secret
  • authorization: it will approve the used tokens and any additional users login, eventually skipping the next auth-plugin configured

Usage

There are some type of usage:

Type Description
middleware-only This inject a valid auth token in the authorization header and it is up to the auth plugins configure to manage the login
authorization-only With this setting you can define an "allowList" of users that will skip all the auth plugins and will automatically return a login ok
middleware+authorization You can comine these two types giving the access only to a defined set of tokens, so users will continue to use others auth plugins configured

middleware-only

middlewares:
  static-token:
    - token: mySecureToken
      user: systemUser
      password: systemPassword
    - token: ABCD1234
      user: uncle
      password: tom

If a request have the header Authorization: Bearer mySecureToken, it will be replace at runtime with a token that act as systemUser. All the auth plugins configured in Verdacco will receive the user and password you have setted.

Whenever you configure the token field value use long and random strings.

NB: if the user you have set require the 2FA, the authentication will fail. So it is up to you to configure a static application-user.

authorization-only

auth:
  static-token:
    - doo
    - foo
    - bar
  ldap:
    ...
  other-auth-plugin:
    ...

This configuration will skip the all the auth plugins that comes after the static-token plugin. In this example the users doo, foo and bar can access without a valid password.

Of course use this feature with caution!

middleware+authorization

auth:
  static-token:
  ldap:
    ...
middlewares:
  static-token:
    - token: mySecureToken
    - token: ABCD1234

The best setting of this plugin is to combine the two possible uses, in this way it gives access to the Verdaccio registry only to a list of tokens.

The tokens will not act as other users and the static-token auth plugin will authorize only the tokens, so all the others users must login as usual.

NB: if the static-token auth plugin isn't the first of the list, the token will be rejected! As before, the token value must long and random!

Where I have to set the token in my npm client?

To set the token in your npm client you have to add it to your user config.

This command will append a valid setting:

# view where the file is located
npm config get userconfig

# append a login access
echo '//localhost:4873/:_authToken="mySecureToken"' >> `npm config get userconfig`

The pattern of the string appended is: //<url of the registry>/:_authToken="<static-token>". You can find more info here.

License

Copyright Manuel Spigolon, Licensed under MIT.

verdaccio-static-token's People

Contributors

eomm avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.