I understand the difference between Passport.js' Basic and Digest authentication, but what is the difference between the local strategy and Basic or Digest? In all three, you enter a username and password. Is the Basic strategy a type of user & password authentication? Please clarify.
passport-local is the strategy you would use if you are authenticating against a username and password stored 'locally' i.e. in the database of your app - 'local' means local to your application server, not local to the end user.
What is Passport. js? Passport is authentication middleware for Node. js. As it's extremely flexible and modular, Passport can be unobtrusively dropped into any Express-based web application.
Funding. This software is provided to you as open source, free of charge.
If I understand correctly, the differences between the Local, Basic and Digest strategies in Passport.js are subtle but important. Here's the rundown:
Local (passport-local)
Passport's local strategy is a simple username and password authentication scheme. It finds a given user's password from the username (or other identifier) and checks to see if they match. The main difference between the local strategy and the other two strategies is its use of persistent login sessions. This strategy should be used over SSL/TLS.
Basic (passport-http)
The Basic strategy implemented by Passport looks nearly identical to the local strategy, with one subtle difference. The basic strategy is to be used with API endpoints where the architecture is stateless. As a result, sessions are not required but can be used. This strategy should also use SSL/TLS. The session flag can be set like so:
app.get('/private', passport.authenticate('basic', { session: false }), function(req, res) { res.json(req.user); });
Digest (passport-http)
The digest strategy is subtly different than the other two strategies in that it uses a special challenge-response paradigm so as to avoid sending the password in cleartext. This strategy would be a good solution when SSL/TLS wouldn't be available.
This is a good article on Basic vs. Digest: How to Authenticate APIs
Note: All three strategies make session support optional. The two passport-http strategies allow you to set the session flag while the Passport docs say this, regarding the passport-local strategy:
Note that enabling session support is entirely optional, though it is recommended for most applications.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With