[nodejs] Passport how to authentication between services ?

[Trieu Le]

Hi guys,

I have a question about passport on NodeJS
I have 2 projects using passport on Nodejs, first project includes some
views for user interface (frontend), this project using passport for
authentication with mongodb and express. Another project includes all REST
API services.
My problems is: first project is running on: http://localhost:80 and it
call API of second project which running on http://localhost:1234/api
How can i secure my second project ? This project included all of REST API
for first project.

Thanks !
--
Job board: http://jobs.nodejs.org/
New group rules: https://gist.github.com/othiym23/9886289#file-moderation-policy-md
Old group rules: https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines
---
You received this message because you are subscribed to the Google Groups "nodejs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to nodejs+***@googlegroups.com.
To post to this group, send email to ***@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/nodejs/7359b1f7-7f6e-45b9-ab88-2b26ead7220d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Zlatko]

Well, as you've said yourself, your first project uses passport-mongodb or similar authentication strategy. What does your second project use? Are you accessing it exclusively server-to-server or also regular fashion, from a client? If it's server to server, do you need to also pass along authorization info (oh behalf of which user is the first server asking for resources on the second)?

In general, you can use some relatively simple way, like encrypt the communication with a preshared key or similar. But in most cases, you should try to implement something like OAuth.

With OAuth, you have ensured all of these scenarios - server-to-server, client-to-server, server-to-server with clients authorization etc.
--
Job board: http://jobs.nodejs.org/
New group rules: https://gist.github.com/othiym23/9886289#file-moderation-policy-md
Old group rules: https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines
---
You received this message because you are subscribed to the Google Groups "nodejs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to nodejs+***@googlegroups.com.
To post to this group, send email to ***@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/nodejs/1c883541-c7ea-4688-a059-a15dd7502bce%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.