We're using Loopback for our REST endpoints and would like to implement JWT without using the Loopback User model. Meaning, we want to validate each call to the rest endpoints ourselves using something like jwt-simple for tokens. Is there a way to have Loopback call a custom authentication function on each inbound request and either accept or reject the request?. All of the solutions we've found are tied to Loopback's user model, but we have our own user model. The following code might suffice but Loopback seems be overriding the '/api' route:
app.use('/api', function(req,res,next) {
// PERFORM CUSTOM VALIDATION GOES HERE. ACCEPT OR REJECT THE CALL.
next();
})
FOLLOWUP QUESTION #1 -- How are parameters defined in middleware using JS? In order to perform the authentication in code we need the request, response, user and/or token.
app.middleware('auth:before', auth(???????))
function auth(req, res, next) {
console.log(req, res);
}
FOLLOWUP ANSWER #1 -- Here's the solution:
app.middleware('auth:before', auth)
function auth(req, res) {
console.log(req, res);
}
FOLLOWUP QUESTION #2 -- How do you actually deny access using middleware? (#1 above).
