In conjunction with establishing client session objects, a Node server often demands authentication credentials. The theory and practice of web security is extensive. We want to simplify our understanding into two main authentication scenarios:
When the wire protocol is HTTPS
When it is HTTP
The first is naturally secure, and the second is not. For the first we will learn how to implement Basic authentication in Node, and for the second a challenge-response system will be described.
As mentioned, Basic authentication sends plain text over the wire containing a username/password combination, using standard HTTP headers. It is a simple and well-known protocol. Any server sending the correct headers will cause any browser to display a login dialog, like the following one:
Nonetheless this method remains insecure, sending non-encrypted data in plain text over the wire. For the sake of simplicity we will demonstrate this authentication method on a HTTP...