title: Setting up passport-jwt authentication
body: <p>I'm having some trouble setting up <code>passport-jwt</code> with my <code>express</code> api server.</p>
  
  <p>On the front end I'm using <code>ember.js</code> to post to the <code>/auth</code> route the credentials that should authenticate the session and then the library in <code>ember.js</code> will handle sending the token in subsequent requests.</p>
  
  <p>I followed <a href="http://scottksmith.com/blog/2014/05/29/beer-locker-building-a-restful-api-with-node-passport/" rel="nofollow">this tutorial</a> loosely and switched out their <code>passport-http</code> with <code>passport-jwt</code> instead, setting it up with the example in <a href="https://github.com/themikenicholson/passport-jwt" rel="nofollow">the git repo</a>.</p>
  
  <p>In my <code>server.js</code> I have required passport and set it up as middleware using <code>app.use(passport.initialize());</code></p>
  
  <p>At the bottom of the <code>server.js</code> file I call my api routes file with <code>app.use('/api/v1', '/app/routes/api');</code></p>
  
  <p>My <code>app/routes/api.js</code> file looks has a section for adding and getting users like this</p>
  
  <pre><code>router.route('/users')
    .post(function(req,res) { user.addUser(req,res) })
    .get(function(req,res) { user.getAllUsers(req,res) });
  </code></pre>
  
  <p>Which are references to exports in the <code>api/user.js</code> file which look like this</p>
  
  <pre><code>var mongoose = require('mongoose');
  var User = require('../../models/user');
  
  module.exports.addUser = function(req, res) {
    var user = new User(req.body.user);
  
    user.save(function(err) {
      if (err)
        res.send(err);
      res.json({user: user});
    });
  };
  
  module.exports.getAllUsers = function(req, res) {
    User.find(function(err, users) {
        if (err) {
          res.send(err);
        }
        res.json({users: users});
    });
  };
  </code></pre>
  
  <p>The model is pretty straight forward, it attempts to hash the password on save provided it hasn't changed (I'm assuming this is for <code>PUT</code> requests) along with a password verification class method</p>
  
  <pre><code>var mongoose = require('mongoose');
  var bcrypt = require('bcrypt-nodejs');
  
  var UserSchema = new mongoose.Schema({
      username: {
          type: String,
          unique: true,
          required: true
      },
      password: {
          type: String,
          required: true
      }
  });
  
  UserSchema.pre('save',function(callback){
      var user = this;
  
      if(!user.isModified('password')) return callback();
  
      bcrypt.genSalt(5, function(err, salt){
          if (err) return callback(err);
  
          bcrypt.hash(user.password, salt, null, function(err, hash){
              if (err) return callback(err);
              user.password = hash;
              callback();
          });
      });
  });
  
  UserSchema.methods.verifyPassword = function(password) {
    return bcrypt.compareSync(password, this.local.password);
  };
  
  module.exports = mongoose.model('User',UserSchema);
  </code></pre>
  
  <p>For my other API endpoints I am passing in my <code>isAuthenticated</code> method from the <code>controllers/auth.js</code> like so</p>
  
  <pre><code>router.route('/followers')
    .post(authController.isAuthenticated, function(req,res) { follower.addFollower(req,res) })
    .get(authController.isAuthenticated, function(req,res) { follower.getAllFollowers(req,res) });
  </code></pre>
  
  <p>That export in the controller file looks like</p>
  
  <pre><code>var dotenv = require('dotenv');
  dotenv.load();
  
  var passport = require('passport');
  var JWTStrategy = require('passport-jwt').Strategy;
  var User = require('../models/user');
  
  var opts = {};
  opts.secretOrKey = process.env.PASSPORT_SECRET || 'secretsauce';
  passport.use(new JWTStrategy(opts, function(jwt_payload, done){
      User.findOne({id: jwt_payload.sub}, function(err, user){
          if (err) {
              return done(err, false);
          }
          if (!user) { return done(null,false); }
          user.verifyPassword(password, function(err,isMatch){
              if (err) { return done(err, false); }
              if(!isMatch) { return done(null,false); }
              done(null, user);
          });
      });
  }));
  
  exports.isAuthenticated = passport.authenticate('jwt', { session : false });
  </code></pre>
  
  <p>I think this area is where I'm getting confused on how I'm supposed to authenticate with the express server. I can add users and their passwords are being hashed correctly but how do I actually authenticate a user. Specifically how would I go about authorizing them on the <code>POST</code> to the <code>/auth</code> route? I am using postman to test the API so if someone could maybe explain how to test with a jwt in postman that would be cool. I know I have to set a header to the token I get from authenticating but I am stuck understanding how to authenticate.</p>