dwyl / hapi-auth-jwt2

:lock: Secure Hapi.js authentication plugin using JSON Web Tokens (JWT) in Headers, URL or Cookies
ISC License
798 stars 126 forks source link

Define a way to ignore which uris should not be have authorization header #22

Closed diegodfsd closed 9 years ago

diegodfsd commented 9 years ago

I'm using hapi-swagger and after that I added the jwt2 to my project I started taking a error when I access the documentation. The error generated because in this url there is not a authorization header and should not have it even. I think that should a way to inform which urls should have this header or there might be a pre-authenticate method where we can do what we want before authenticate.

Here we can see the code that is generating the error.

      var auth = request.headers.authorization;
      if (!auth) {
        return reply(Boom.unauthorized(null, 'Token not present'));
      }
nelsonic commented 9 years ago

@diegodfsd this is because the swagger urls are not being registered as auth:false. see: http://hapijs.com/tutorials/auth#mode You can remedy this in your project by setting the default to try.

diegodfsd commented 9 years ago

@nelsonic You are totally right I updated hapi-swagger and everything did work. I don't checked hapi-swagger's documentation to know if was possible it by pass the arguments to hapi.

Thanks

nelsonic commented 9 years ago

@diegodfsd sweet. glad it worked for you. Please star the repo to help us get more visibility. Abraço!