Please Note: This repository is experimental and will be archived. To protect Express.js APIs with JWT Bearer Tokens we recommend express-oauth2-jwt-bearer (See the blog post for more details).
Authentication middleware for Express.js that validates access tokens following RFC 6750. The purpose of this library is to protect OAuth 2.0 resources.
Table of Contents
- Installation
- Getting Started
- Contributing
- Support + Feedback
- Vulnerability Reporting
- What is Auth0
- License
Installation
This library is installed with npm:
npm i express-oauth2-bearer --save
Getting Started
The library needs the following values to authroize requests:
- Issuer Base URL: The base URL of the authorization server. If you’re using Auth0, this is your tenant Domain pre-pended with
https://
(likehttps://tenant.auth0.com
) found on the Settings tab for your Application in the Auth0 dashboard. - Allowed Audiences: Audience identifier (or multiple separated by a comma) allowed for the access token. If you’re using Auth0, this is the Identifier found on the Settings tab for your API in the Auth0 dashboard.
These can be configured in a .env
file in the root of your application:
# .env
ISSUER_BASE_URL=https://YOUR_DOMAIN
ALLOWED_AUDIENCES=https://api.yourapplication.com
… or in your application code:
const { auth } = require('express-oauth2-bearer');
app.use(auth({
issuerBaseURL: 'https://tenant.auth0.com',
allowedAudiences: 'https://api.yourapplication.com'
}));
The OpenID strategy is the default strategy for token validation. With the configuration values set in the .env
file, the following code will restrict requests to all proceeding routes to ones that have a valid access token with the https://api.yourapplication.com
audience and the read:products
scope:
If access tokens are not expected to be signed like OpenID Connect ID tokens, add the auth
middleware with a callback to validate as follows:
API Documentation:
auth()
accepts an asynchronous function receiving an access token and returning a set of claims.
requiredScopes()
accepts either a string or an array of strings.
strategies.openid
accepts the following parameters:
Name | Default | Description |
---|---|---|
issuerBaseURL | env.ISSUER_BASE_URL |
URL for the token issuer. |
allowedAudiences | env.ALLOWED_AUDIENCES.split(',') |
Allowed audiences for the token. |
clockTolerance | 5 |
Clock tolerance in seconds for token verification, aka leeway. |
clientSecret | env.CLIENT_SECRET |
Client secret, required for tokens signed with symmetric algorithms. |
Contributing
We appreciate feedback and contribution to this repo! Before you get started, please see the following:
Contributions can be made to this library through PRs to fix issues, improve documentation or add features. Please fork this repo, create a well-named branch, and submit a PR with a complete template filled out.
Code changes in PRs should be accompanied by tests covering the changed or added functionality. Tests can be run for this library with:
npm install
npm test
When you’re ready to push your changes, please run the lint command first:
npm run lint
Support + Feedback
Please use the Issues queue in this repo for questions and feedback.
Vulnerability Reporting
Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
What is Auth0?
Auth0 helps you to easily:
- implement authentication with multiple identity providers, including social (e.g., Google, Facebook, Microsoft, LinkedIn, GitHub, Twitter, etc), or enterprise (e.g., Windows Azure AD, Google Apps, Active Directory, ADFS, SAML, etc.)
- log in users with username/password databases, passwordless, or multi-factor authentication
- link multiple user accounts together
- generate signed JSON Web Tokens to authorize your API calls and flow the user identity securely
- access demographics and analytics detailing how, when, and where users are logging in
- enrich user profiles from other data sources using customizable JavaScript rules
License
This project is licensed under the MIT license. See the LICENSE file for more info.