loopback-ssl

Node module to enable HTTPS/SSL in a loopback application with simple configurations. The module also enables trusted peer authentication.

Features

Enable SSL in Loopback application
Enable mutual SSL authentication in Loopback

Usage

Setup

Install loopback:

slc loopback <app-name>

cd <app-name>

Install loopback-ssl:

npm install loopback-ssl --save

Setup Configuration:

Add the following lines of configuration in 'config.json' in location "<app-dir>/server/config.json"

  "httpMode": false,
  "certConfig": {
    "path": "/certificate/path/",
    "key": "local.pem",
    "cert": "local.crt.pem",
    "ca": [],
    "requestCert": false,
    "rejectUnauthorized": false
  }

Configure server.js

Edit the server.js located at "<app-dir>/server/server.js"

Add the following line at the top of the code.

var loopbackSSL = require('loopback-ssl');

Replace the all the content within the code block starting with

app.start = function() { ... }

boot(app, __dirname, function(err) { ... });

with following code

boot(app, __dirname, function(err) {
  if (err) throw err;
});

return loopbackSSL.startServer(app);

Example server.js

For example, the bare minimum server.js should look like

var loopback = require('loopback');
var boot = require('loopback-boot');
var loopbackSSL = require('loopback-ssl');

var app = module.exports = loopback();

boot(app, __dirname, function(err) {
  if (err) throw err;
});

return loopbackSSL.startServer(app);

Option 1: Enable HTTP (default loopback configuration)

The configuration entry "httpMode": true will enable http (disable https). In this mode the "certConfig": {..} configuration is not required and can be omitted.

  "httpMode": true

Option 2: Enable HTTPS

The configuration entry "httpMode": false will enable https.

  "httpMode": false,
  "certConfig": {
    "path": "/certificate/path/",
    "key": "serverkey.pem",
    "cert": "server-certificate.pem",
    "ca": [],
    "requestCert": false,
    "rejectUnauthorized": false
  }

"path" - folder location where the certificates files will be installed
"key" - server key
"cert" - server certificate

Option 3: Enable Mutual SSL authentication

  "httpMode": false,
  "certConfig": {
    "path": "/certificate/path/",
    "key": "serverkey.pem",
    "cert": "server-certificate.pem",
    "ca": [
        "client-certificate-to-validate.pem"
    ],
    "requestCert": true,
    "rejectUnauthorized": true
  }

The ca[] configuration contains the list of client certificates which the server will authenticate
"requestCert": true enables mutual SSL authentication
"rejectUnauthorized": true enables the authenticity and validity check of client keys
For any reason, if the client certificate is a self signed certificate, "rejectUnauthorized": can be set to false.

Contributing

Fork it ( https://github.com/yantrashala/loopback-ssl/fork )
Create your feature branch (git checkout -b new-feature)
Commit your changes (git commit -am 'Add some feature')
Push to the branch (git push origin new-feature)
Create new Pull Request

License

MIT.

NelsonT20/loopback-ssl