passport-http

passport-http implements the HTTP Basic and HTTP Digest authentication schemes as Passport strategies, letting Node.js applications authenticate requests directly from the standard Authorization header rather than building a session-based login flow. It plugs into any Connect-style middleware stack, including Express, and is commonly used to protect internal APIs, admin endpoints, or services consumed by machines rather than browsers.

Both strategies follow the same Passport contract: a verify callback receives credentials extracted from the request and calls back with a user object (or false for invalid credentials). Because Basic and Digest auth are stateless, requests can be authenticated with session: false, avoiding the overhead of session middleware for API-only routes.

What You Get

• A BasicStrategy implementing RFC 2617 HTTP Basic authentication with a configurable realm
• A DigestStrategy implementing HTTP Digest authentication with nonce/qop validation
• Stateless authentication compatible with session: false for API-only routes
• An optional passReqToCallback option to access the request object inside the verify callback
• Drop-in integration with passport.authenticate() alongside any other Passport strategy

Common Use Cases

• Protecting internal or admin-only API endpoints with a username/password check instead of full session login
• Authenticating machine-to-machine or CLI clients that send credentials directly in the Authorization header
• Adding a lightweight auth layer to Express services that already use Passport for other strategies
• Implementing HTTP Digest auth where credentials must not be sent in cleartext across a request

Under The Hood

Architecture - The module is a thin adapter over passport-strategy: lib/passport-http/index.js simply re-exports BasicStrategy and DigestStrategy from lib/passport-http/strategies/, each of which subclasses passport.Strategy via util.inherits and implements a single authenticate(req) method that parses the Authorization header, extracts credentials, and calls into an application-supplied verify function before invoking this.success, this.fail, or this.error. There is no internal state beyond the realm/options captured at construction time, so each strategy instance is safe to reuse across requests.

Tech Stack - Written in plain, dependency-light CommonJS JavaScript targeting Node >= 0.4.0; its only runtime dependency is passport-strategy, with vows used for the test suite and make-node driving the Makefile-based build/test scripts, reflecting its 2011-era origins predating npm scripts becoming the norm.

Code Quality - The test/ directory (vows-based, using assert.isFunction) only checks that BasicStrategy and DigestStrategy are exported functions; it does not exercise the actual authentication logic, header parsing, or the Digest nonce/qop validation paths, so real behavioral coverage is thin. The source itself is short, readable, and consistently documented with JSDoc-style comments describing options and examples.

API Design - The API mirrors other Passport strategies closely: construct with (options, verify), register via passport.use(), and authenticate via passport.authenticate('basic'|'digest', { session: false }), which keeps the learning curve low for anyone already familiar with Passport’s ecosystem. The verify callback signature (function(userid, password, done)) is minimal and unopinionated about the user-lookup implementation, at the cost of leaving Digest’s nonce/replay validation as an optional, easy-to-skip validate callback.