Proposed fix for challenge / response

[apowers313]

This pull request adds a new strategy augmentation similar to strategy.pass() and strategy.fail() that is intended to support challenge / response type authentication protocols as mentioned in #488 . The new method is strategy.raw(), which is roughly the same as res.send(). It supports options for res.json(), res.type() and res.status() since those seem like those would be the most useful features to people.

[coveralls]

Coverage decreased (-2.3%) to 97.085% when pulling 41990d4 on apowers313:master into 07bff37 on jaredhanson:master.

[jaredhanson]

To facilitate a discussion of what the best approach to this is, could you link to a strategy that uses this proposed capability?

Sent from my iPhone

On May 28, 2016, at 4:11 PM, Adam Powers [email protected] wrote:

This pull request adds a new strategy augmentation similar to strategy.pass() and strategy.fail() that is intended to support challenge / response type authentication protocols as mentioned in #488 . The new method is strategy.raw(), which is roughly the same as res.send(). It supports options for res.json(), res.type() and res.status() since those seem like those would be the most useful features to people.

You can view, comment on, or merge this pull request online at:

#489

Commit Summary

bumping version
proposed fix for #488
File Changes

M lib/middleware/authenticate.js (27)
M package.json (2)
Patch Links:

https://github.com/jaredhanson/passport/pull/489.patch
https://github.com/jaredhanson/passport/pull/489.diff
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

[apowers313]

An example strategy is here:
https://github.com/apowers313/passport-webauthn

Note that Chrome and Firefox are shipping WebAuthn around May -- it would be great to have a solution for this by then.

[apowers313]

@jaredhanson now that WebAuthn is taking off, I'm dusting off this old PR.

Any thoughts about adding a raw() response method for challenge / response protocols?

[kohtala]

I don't think it is your task to update package.json.

[dnepro]

Hi, first of thanks a lot for passport i love using it and i would love to see #488 merged and as @apowers313 pointed out this is the only thing that is left for it to be merged and this is already 4 years old.

Is there some actual concern with this change?

For me it doesn't seem like other parts could be affected by this change (because it adds a new function) and with ~143 bytes (gzipped, ) excluding spaces it would only add 224 bytes (without comments and spaces) or 124 bytes (gzipped and minified) which seems really reasonable for such a great benefit of being able to use U2F/hardware tokens with Passport

[jaredhanson]

I'm reviving this thread with a comment on the original issue: #488 (comment)

Please send me your feedback by continuing the discussion there. Thanks!