Security News
Introducing the Socket Python SDK
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.
@dmapper/passport-linkedin-oauth2
Advanced tools
A simple Passport strategy for LinkedIn OAuth2 that works with lite profile.
This fork implements optional callback function that can be used to pass client id and secret to initialise oauth2 each time directly before an authentication. This function is called with the request object.
var LinkedInStrategy = require('@dmapper/passport-linkedin-oauth2').Strategy;
passport.use(new LinkedInStrategy({
getClient: async function(req) {
// some possible async operations
// ...
return {
id: '#####',
secret: '#####'
}
},
callbackURL: "http://127.0.0.1:3000/auth/linkedin/callback",
scope: ['r_emailaddress', 'r_liteprofile'],
},
function(accessToken, refreshToken, profile, cb) {
// To keep the example simple, the user's LinkedIn profile is returned to
// represent the logged-in user. In a typical application, you would want
// to associate the LinkedIn account with a user record in your database,
// and return that user instead.
return done(null, profile);
}
));
====================================================================================
npm install @dmapper/passport-linkedin-oauth2
Register the strategy
var LinkedInStrategy = require('@dmapper/passport-linkedin-oauth2').Strategy;
passport.use(new LinkedInStrategy({
clientID: LINKEDIN_KEY,
clientSecret: LINKEDIN_SECRET,
callbackURL: "http://127.0.0.1:3000/auth/linkedin/callback",
scope: ['r_emailaddress', 'r_liteprofile'],
}, function(accessToken, refreshToken, profile, done) {
// asynchronous verification, for effect...
process.nextTick(function () {
// To keep the example simple, the user's LinkedIn profile is returned to
// represent the logged-in user. In a typical application, you would want
// to associate the LinkedIn account with a user record in your database,
// and return that user instead.
return done(null, profile);
});
}));
and then authenticate as:
app.get('/auth/linkedin',
passport.authenticate('linkedin', { state: 'SOME STATE' }),
function(req, res){
// The request will be redirected to LinkedIn for authentication, so this
// function will not be called.
});
the login callback:
app.get('/auth/linkedin/callback', passport.authenticate('linkedin', {
successRedirect: '/',
failureRedirect: '/login'
}));
See this for details on LinkedIn API.
state
paramThe state
param is used to prevent CSRF attacks, and is required by the LinkedIn API. You can ask Passport to handle the sending and validating of the state
parameter by passing state: true
as an option to the strategy:
var LinkedInStrategy = require('@dmapper/passport-linkedin-oauth2').Strategy;
passport.use(new LinkedInStrategy({
clientID: LINKEDIN_KEY,
clientSecret: LINKEDIN_SECRET,
callbackURL: "http://127.0.0.1:3000/auth/linkedin/callback",
scope: ['r_emailaddress', 'r_liteprofile'],
state: true
}, function(accessToken, refreshToken, profile, done) {
// asynchronous verification, for effect...
process.nextTick(function () {
// To keep the example simple, the user's LinkedIn profile is returned to
// represent the logged-in user. In a typical application, you would want
// to associate the LinkedIn account with a user record in your database,
// and return that user instead.
return done(null, profile);
});
}));
and then authenticate as:
app.get('/auth/linkedin',
passport.authenticate('linkedin'),
function(req, res){
// The request will be redirected to LinkedIn for authentication, so this
// function will not be called.
});
If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
This project is licensed under the MIT license. See the LICENSE file for more info.
FAQs
Passport for LinkedIn OAuth2 API v2
We found that @dmapper/passport-linkedin-oauth2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 27 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.
Security News
Floating dependency ranges in npm can introduce instability and security risks into your project by allowing unverified or incompatible versions to be installed automatically, leading to unpredictable behavior and potential conflicts.
Security News
A new Rust RFC proposes "Trusted Publishing" for Crates.io, introducing short-lived access tokens via OIDC to improve security and reduce risks associated with long-lived API tokens.