eberttc / moleculer-protect-services

Protect services

moleculer-protect-services

This repo demonstrates how to use JWT token to protect service actions. It contains a ServiceGuard middleware and a guard service which implement this feature.

Setup

1. Generate JWT token for every service. Use the call guard.generate --service myService command in REPL to generate a JWT for a service. The received token put into authToken property in service schema:

   module.exports = {
       name: "users",
   
       authToken: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXJ2aWNlIjoidXNlcnMiLCJpYXQiOjE1NDE4NTU0ODl9.td1P27_xpFv1P5_j0HLtMwyz-aRF9xQqjLHYIIHcKPE",
   
       ...
   }

   In production you had better place it into environment variables like USERS_AUTH_TOKEN and use authToken: process.env.USERS_AUTH_TOKEN in schema

2. Define restriction in action definition. If restricted property is null or not defined it means the action can be called from every service.

   actions: {
       create: {
           // It can be called by "api" service
           restricted: [
               "api"
           ],
           handler(ctx) {}
       },
   
       list: {
           // It can be called by everyone.
           restricted: null,
           handler(ctx) {}
       },
   
       posts: {
           // It can be called by "api" & "posts" service.
           restricted: [
               "api",
               "posts"
           ],
           handler(ctx) {}
       }
   },

3. Add ServiceGuard middleware to moleculer.config.js

   module.exports = {
       logger: true,
       logLevel: "info",
   
       middlewares: [
           ServiceGuard
       ]
   };

Try

Try the following command in REPL:

• call users.create - throw error because it is called directly, not from the api service

• call users.list - returns "OK" because it is not restricted

• call users.posts - throw error because it is called directly, not from api or posts service

• call posts.createUser - throw error because it is called from posts service and not from api service

• call posts.userPosts - returns "OK" because it is called from posts service.

• open http://localhost:3000/api/users/create in the browser - returns "OK" because it is called from the api service.

Start

# Install dependencies
npm install

# Start with REPL
npm run dev