Validate expressjs api calls using ASP.net Identity 2

Question

I am building a rest api using asp.net & identity 2. This is my primary data api.

I am also building another api using expressjs for searching data stored in a search index.

Angular spa will be consuming both these apis for data and searching needs.

How can I secure expressjs api calls using the bearer token that asp.net identity is already providing to angular when a user logs in?

Answer 1

To achieve this you need to have a token consumption middle ware in your expressjs API. I have done this as below

1. Built a authorization server using JWT with WEB API and ASP.Net Identity as explained here http://bitoftech.net/2015/02/16/implement-oauth-json-web-tokens-authentication-in-asp-net-web-api-and-identity-2/
2. Write a consumption logic (i.e. middleware) in all my other APIs (Resource servers) that I want to secure using same token. Since you have another API in expressjs you need to do something like below

npm install jsonwebtoken

Refer - https://jwt.io

    var apiRoutes = express.Router(); 
    apiRoutes.use(function(req, res, next) 
    {      
    // check header or url parameters or post parameters for token
    var token = req.body.token || req.query.token || req.headers['x-access-token'];

    // decode token
    if (token) {

      // verifies secret and checks exp
      jwt.verify(token, app.get('superSecret'), function(err, decoded) 
    {      
        if (err) 
      {
          return res.json({ success: false, message: 'Failed to authenticate token.' });    
        } 
      else 
      {
          // if everything is good, save to request for use in other routes
          req.decoded = decoded;    
          next();
        }
      });    
    } 
    else 
    {

      // if there is no token
      // return an error
      return res.status(403).send({ 
          success: false, 
          message: 'No token provided.' 
      });

    }
  });

Refer - https://scotch.io/tutorials/authenticate-a-node-js-api-with-json-web-tokens

P.S. - I have done this with a web API issuing JWT (Authorization server or Auth & resource server) and successfully able to secure APIs built in python (resource server) and spring (resource server).

Answer 2

Try express-bearer-token. This seems to fit your description

https://www.npmjs.com/package/express-bearer-token