Search code examples
node.jsjwtpassport.jsexpress-jwtpassport-jwt

Should I use express-jwt or passport-jwt for securing an Express/Angular app?

I'm trying to figure out passport. I want to secure an API-based frontend (Angular).

I assume that means I can't use passport-local, and that I must use passport-http to get the username/password, and then passport-jwt to perform JWT signing and verification. Correct?

However then it gets confusing, because there is an even more popular package called express-jwt. Are they different? I'm not sure which is used for what purpose.

Solution

  • They are very similar. But passport is unmaintained, there are bugs in many of its plugins ("strategies"), and dozens of PRs that will never get merged.

    So I went with express-jwt, which is maintained.