Simple authentication (Wildcard sessions)

The idea is to allow the server to modify the context:

server.login = async function(username, password) {
   if (await invalidCredentials(username, password)) {
     return;
   }

   // `this.user` is persisted
   this.user = {
     username,
   };

   // The user is now logged-in!
};

server.getUserPosts = async function() {
  // `this.user` was set by a previous `server.login` call
  const {user} = this;

  if (!user) {
    // Not logged-in
    return;
  }

  // The user is logged-in!

  const posts = await db.getUserPosts(user);

  // ...
};

~~~ EDIT ~~~

What happens here is that Wildcard sets a first cookie with the value of this.user and a second cookie with a signature.

Cookie Name	Cookie Value
wildcard_user	{“username”:“brillout”}
wildcard-signature_user	60a3939232aehua12031389e99d52977e1c282

The signature ensures that the cookie was set by the server.

Wildcard sessions can be used to easily implement any auth strategy:

// Username + password
server.login = function(username, password) {
  if (await invalidCredentials(username, password)) return;
  this.user = { username }; // Wildcard will automatically persist `this.user` by using HTTP cookies
};

// OAuth
server.oauthCallback = function(userProfile) {
   // At the end of the OAuth flow, we save the user information to the context object
   this.user = userProfile; // Wildcard will automatically persist `this.user` by using HTTP cookies
};

// Etc.

I’ve already implemented a first prototype which I’m currently using in production.

[brillout]

Wildcard Sessions only does session management; you can use it with any auth strategy:

// Username + password
server.login = function(username, password) {
  if (await invalidCredentials(username, password)) return;
  this.user = { username }; // Wildcard will automatically persist `this.user` by using HTTP cookies
};

// OAuth
server.oauthCallback = function(userProfile) {
   // At the end of the OAuth flow, we save the user information to the context object
   this.user = userProfile; // Wildcard will automatically persist `this.user` by using HTTP cookies
};

// Etc.

Instead of dealing with cookies you simply deal with reading/writing the context object.

[michie1]

https://github.com/reframejs/wildcard-api/pull/58#issuecomment-711412477

I’m curious, you mentioned a while ago using getContext to set cookies, are you still using that approach? What do you think of #59?

I’m only using it in a small inactive pet project, but yes. Besides putting data in the context from Express, I’m also putting functions in it. It works fine. I think it’s nicer to assign the those functions to the context than to the server object. If you read the code you would think the functions are provided by the library, because server is imported from the library.

I would prefer to move Wildcard sessions to its own plugin/library, because I would prefer to handle those things myself, although it’s definitely a nice idea to showcase Wildcard and have some authentication running quickly.