Sails hook that provides jwt authentication scheme, such as policies, routes, controllers, services.




Hook that provides jwt authentication sails-compatible scheme, such as policies, routes, controllers, services.


Within a Sails App structure:

npm install --save sails-hook-jwt-auth


This module globally expose a service which integrates with the jsonwebtoken ( and provide the interface to apply the jwt specification (

var jwt = require('jsonwebtoken');

module.exports.issueToken = function(payload, options) {
  var token = jwt.sign(payload, process.env.TOKEN_SECRET || sails.config.jwt.token_secret, options);
  return token;

module.exports.verifyToken = function(token, callback) {
  return jwt.verify(token, process.env.TOKEN_SECRET || sails.config.jwt.token_secret, {}, callback);


The authToken.js policy is just like any other Sails policy and can be applied as such. It's responsible for parsing the token from the incoming request and validating it's state.

module.exports = function(req, res, next) {
  var token;

  if ( req.headers && req.headers.authorization ) {
    var parts = req.headers.authorization.split(' ');
    if ( parts.length == 2 ) {
      var scheme = parts[0],
        credentials = parts[1];

      if ( /^Bearer$/i.test(scheme) ) {
        token = credentials;
    } else {
      return res.json( 401, { err: { status: 'danger', message: res.i18n('auth.policy.wrongFormat') }});
  } else if ( req.param('token') ) {
    token = req.param('token');
    // We delete the token from param to not mess with blueprints
    delete req.query.token;
  } else {
    return res.json( 401, { err: { status: 'danger', message: res.i18n('auth.policy.noAuthorizationHeaderFound') }});

  TokenAuth.verifyToken(token, function(err, decodedToken) {
    if ( err ) return res.json( 401, { err: { status: 'danger', message: res.i18n('auth.policy.invalidToken'), detail: err }});

    req.token = decodedToken.sub;


Use it as you would use any other sails policy to enable jwt authentication restriction to your Controllers/Actions:

module.exports.policies = {
  'UserController': ['authToken'],


This hook sets up a basic User model with some defaults attributes required to implement the jwt authentication scheme.

var bcrypt = require('bcrypt');
module.exports = {

  attributes: {
    email: {
        type: 'email',
        required: true,
        unique: true

    password: {
        type: 'string',
      required: true,

    active: {
      type: 'boolean',
      defaultsTo: true

    isPasswordValid: function (password, cb) {, this.password, cb);

The User model can be extended with any property you want by defining it in your own Sails project.


These are the routes provided by this hook:

module.exports.routes = {
    'post /login' : 'AuthController.login',
    'post /signup' : 'AuthController.signup',
    'get /activate/:token' : 'AuthController.activate'


The POST request to this route /login must be sent with these body parameters:

    email: '',
    password: 'test123'

The POST response:

    user: user,
    token: jwt_token

Make sure that you provide the acquired token in every request made to the protected endpoints, as query parameter token or as an HTTP request Authorization header Bearer TOKEN_VALUE.


The POST request to this route /signup must be sent with these body parameters:

    email: '',
    password: 'test123',
    confirmPassword: 'test123',

The POST response:

If account activation feature is disabled, the reponse will be the same as the POST /login. If it's enabled you will set the response as you want in the sendAccountActivationEmail function.


Account Activation

This feature is off by default and to enable it you must override the requireAccountActivation configuration and implement the function sendAccountActivationEmail:

module.exports.jwt = {
    requireAccountActivation: true,
    sendAccountActivationEmail: function (res, user, link){'An email must be sent to this email: ',, ' with this activation link: ', link);
        return res.json(200, { success: 'Email has been sent to user!' });