repository·dove·Indexed 12 days ago
https://github.com/feathersjs/feathersA full-stack framework for building web APIs and real-time applications using TypeScript or JavaScript. Feathers is backend-agnostic, supporting various databases and frontend frameworks like React, Vue, and Angular. It provides a comprehensive ecosystem including a CLI, authentication plugins, and multiple transport layers such as REST and Socket.io.
FeathersJS authentication is provided through a collection of plugins that support various mechanisms including username/password, JWT, and OAuth (e.g., GitHub, Facebook).
It is important to note that @feathersjs/authentication is an abstraction layer for authentication mechanisms. It does not handle user management tasks such as user verification or password reset functionality. These must be implemented manually or via external tools like feathers-authentication-management or Auth0.
Feathers Dove (v5) is a major release focused on deep TypeScript integration, schema-driven development, and improved performance. Key improvements include:
@feathersjs/schema for JSON Schema-based validation and automatic TypeScript type generation.When choosing between Feathers and Meteor, consider the following architectural and ecosystem differences:
@feathersjs/adapter-tests package provides a shared test suite designed to validate that database adapters adhere to the common Feathers database adapter syntax. If you are developing a new database adapter for Feathers, you can use this suite to ensure your implementation is compatible with the expected API and behavior.An authentication strategy is an object or class used by the AuthenticationService to validate requests. To be compatible, a strategy must implement at least the authenticate(authentication, params) method.
authenticate(authentication, params): This is the primary method. It takes authentication data and additional parameters. It must either return an authentication result object on success or throw a NotAuthenticated error on failure.Strategies can optionally implement these methods to integrate more deeply with the Feathers application:
setName(name): Sets the name used to register the strategy on the authentication service.setApplication(app): Receives the Feathers application instance.setAuthentication(service): Receives the AuthenticationService instance.verifyConfiguration(): A synchronous method to validate that required configuration fields are present; should throw an error if configuration is invalid.parse(req, res): Parses a plain Node HTTP request/response to extract authentication information. Returns null if no information is found.Feathers provides several ready-to-use strategies:
JWTStrategy (via @feathersjs/authentication)LocalStrategy (via @feathersjs/authentication-local)OAuthStrategy (via @feathersjs/authentication-oauth)// Minimal implementation requirement
class MyCustomStrategy {
async authenticate(authentication, params) {
// logic to validate authentication
// return result object or throw NotAuthenticated
}
}src/app.ts file is the central entry point of a Feathers application. It is responsible for initializing the Feathers app object and wiring it to a specific transport (such as Koa, Express, or Socket.io).The Authentication Service supports three primary flows:
Users can request a new token by calling app.service('authentication').create(data) or POST /authentication. The data object must include the strategy and login credentials:
{ strategy: 'local', username: '...', password: '...' }.
For HTTP requests, the service uses parseStrategies to extract authentication data. It calls the strategy's .parse method, sets the result in params.authentication, and then uses the authenticate hook to verify the credentials and merge the user entity into params (e.g., params.user).
When calling a service internally, you can manually set params.authentication. The authenticate hook will verify this data and merge the resulting entity into params.
Best Practice: For internal requests where you already have the user object, it is more efficient to set params.user directly instead of params.authentication to avoid the overhead of re-verifying the token.
The authentication service emits events on the application instance that you can listen to:
app.on('login', (authenticationResult, params, context) => {}): Emitted after a successful authService.create() call (e.g., an external login request).disconnect event for handling actual disconnections.app.on('logout', (authenticationResult, params, context) => {}): Emitted after a successful authService.remove() call (an explicit logout).Event data structure:
authenticationResult: The return value of the service call (usually contains the user and access token).params: The service call parameters.context: The Feathers hook context.There are two primary flows for OAuth in Feathers:
http(s)://<host>/oauth/<provider>./oauth/<provider>/callback).OAuthStrategy retrieves the profile from the server-side Grant response, finds/creates the user, and generates a JWT.authentication.oauth config. No need to list provider in authStrategies.POST /authentication request with { strategy: '<provider>', accessToken: '<token>' }.authStrategies AND you must override getProfile to verify the token directly with the provider (e.g., via a UserInfo endpoint). Never trust a client-supplied profile.The Core module contains the fundamental building blocks that work on both the client and the server: