What are the differences between local Basic and Digest strategy in passportjs

Question

I understand the difference between Passport.js\' Basic and Digest authentication, but what is the difference between the local strategy and Basic or Digest? In all three, you e

Answer 1

If I understand correctly, the differences between the Local, Basic and Digest strategies in Passport.js are subtle but important. Here's the rundown:

Local (passport-local)

Passport's local strategy is a simple username and password authentication scheme. It finds a given user's password from the username (or other identifier) and checks to see if they match. The main difference between the local strategy and the other two strategies is its use of persistent login sessions. This strategy should be used over SSL/TLS.

Basic (passport-http)

The Basic strategy implemented by Passport looks nearly identical to the local strategy, with one subtle difference. The basic strategy is to be used with API endpoints where the architecture is stateless. As a result, sessions are not required but can be used. This strategy should also use SSL/TLS. The session flag can be set like so:

app.get('/private', passport.authenticate('basic', { session: false }), function(req, res) {
  res.json(req.user);
});

Digest (passport-http)

The digest strategy is subtly different than the other two strategies in that it uses a special challenge-response paradigm so as to avoid sending the password in cleartext. This strategy would be a good solution when SSL/TLS wouldn't be available.

This is a good article on Basic vs. Digest: How to Authenticate APIs

Note: All three strategies make session support optional. The two passport-http strategies allow you to set the session flag while the Passport docs say this, regarding the passport-local strategy:

Note that enabling session support is entirely optional, though it is recommended for most applications.

Answer 2

If you a using the Passport Local strategy: - a session is established, so you don't have to send creds on each request; - username and password are provided in "username" and "password" headers by default;

If you a using the Passport Basic/Digest strategies: - a session is not used, so you must provide the credentials at every API call; - username and password/hash are contained within "Authorization" header;