# Passwordless-RedisStore

This module provides token storage for [Passwordless](https://github.com/florianheinemann/passwordless), a node.js module for express that allows website authentication without password using verification through email or other means. Visit the project's [website](https://passwordless.net) for more details.

Tokens are stored in a Redis database and are hashed and salted using [bcryptjs](https://github.com/dcodeIO/bcrypt.js/).

**bcryptjs has the disadvantage of being slower than the native implementation of bcrypt but is easier to install on Windows machines. If you're looking for an implementation using the native version of bcrypt please use [passwordless-redisstore](https://www.npmjs.org/package/passwordless-redisstore).**


## Usage

First, install the module:

`$ npm install passwordless-redisstore-bcryptjs --save`

Afterwards, follow the guide for [Passwordless](https://github.com/florianheinemann/passwordless). A typical implementation may look like this:

```javascript
var passwordless = require('passwordless');
var RedisStore = require('passwordless-redisstore-bcryptjs');

passwordless.init(new RedisStore(6379, '127.0.0.1'));

passwordless.addDelivery(
    function(tokenToSend, uidToSend, recipient, callback) {
        // Send out a token
    });
    
app.use(passwordless.sessionSupport());
app.use(passwordless.acceptToken());
```

## Initialization

```javascript
new RedisStore([port], [host], [options]);
```
* **[port]:** *(Number)* Optional. Port of your Redis server. Defaults to: 6379
* **[host]:** *(String)* Optional. Your Redis server. Defaults to: '127.0.0.1'
* **[options]:** *(Object)* Optional. This can include options of the node.js Redis client as described in the [docs](https://github.com/mranney/node_redis) and the ones described below combined in one object as shown in the example

Example:
```javascript
passwordless.init(new RedisStore(6379, '127.0.0.1', {
	// option of the node.js redis client
    auth_pass: 'password',
    // options of RedisStore
    redisstore: {
        database: 15,
        tokenkey: 'token:'
    }
}));
```

### Options
* **[redisstore.database]:** *(Number)* Optional. Database to be used. Defaults to: 0
* **[redisstore.tokenkey]:** *(String)* Optional. Keys to be used. UIDs will be appended. Defaults to: 'pwdless:UID'

## Hash and salt
As the tokens are equivalent to passwords (even though only for a limited time) they have to be protected in the same way. passwordless-redisstore uses [bcrypt](https://github.com/ncb000gt/node.bcrypt.js/) with automatically created random salts. To generate the salt 10 rounds are used.

## Tests

`$ npm test`

## License

[MIT License](http://opensource.org/licenses/MIT)

## Author
Florian Heinemann [@thesumofall](http://twitter.com/thesumofall/)