@reaktor/express-gauth
Advanced tools
This is a Node.js module available through the
npm registry. Installation is done using the
npm install command:
$ npm install --save @reaktor/express-gauth
const express = require('express')
const session = require('express-session')
const { expressGAuth } = require('@reaktor/express-gauth')
const app = express()
const allowedLoginFromDomains = ['reaktor.fi', 'reaktor.com']
// Initialize Google auth middleware. You need your Google app id and secret.
const myGauth = expressGAuth({
clientID: process.env.GOOGLE_CLIENT_ID,
clientSecret: process.env.GOOGLE_CLIENT_SECRET,
clientDomain: 'http://localhost:5555',
allowedDomains: allowedLoginFromDomains
})
// Session must be initialized first
app.use(session({
secret: 'lol',
resave: false,
saveUninitialized: true
}))
// Use your configured gauth middleware
app.use(myGauth)
app.get('/', function(req, res) {
res.send(`
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Simple Express GAuth</title>
</head>
<body>
<h1>Hello Reaktorian ${req.user.displayName}!</h1>
</body>
</html>`)
})
app.listen(5555, function() {
console.log('Waiting for Reaktorian Google login at http://localhost:5555')
})
const app = express()
app.use(session(/* options */))
const myGauth = expressGAuth({
googleAuthorizationParams: {
scope: ['profile', 'email']
},
// Other gauth options
})
app.use(myGauth)
app.get('/', function(req, res) {
const accessToken = req.session.passport.user.credentials.access_token
// Access private files with Google API using the access token
})
expressGAuth({
clientID: process.env.GOOGLE_CLIENT_ID,
clientSecret: process.env.GOOGLE_CLIENT_SECRET,
clientDomain: 'http://localhost:5555',
allowedDomains: ['reaktor.fi', 'reaktor.com'], // User needs to login with Google and email with these domains.
allowedEmails: ['john@example.com', 'jussi@example.com'], // These users are allowed login through Google auth.
publicEndPoints: ['/logout'], // These end points do not require any authentication.
ignoreUrlParamsOfPublicEndPoints: true, // Before validating url to match one of the publicEndPoints, the url parameters are stripped away
unauthorizedUser: (req, res, next, user) => res.send(`<h1>Sorry ${user.displayName}, you has no access!</h1>`),
errorPassportAuth: (req, res, next, err) => res.send('<h1>Error logging in!</h1>'),
errorNoUser: (req, res, next) => res.send('<h1>Error logging in, no user details!</h1>'),
errorLogin: (req, res, next, err) => res.send('<h1>Login error in Express, this is odd!</h1>'),
serializeUser: (user, done) => done(null, user),
deserializeUser: (user, done) => done(null, user),
logger: {
log: function() {
console.log('mylog', new Date, JSON.stringify(arguments))
},
error: function() {
console.log('myerror', new Date, JSON.stringify(arguments))
}
},
// Override default authorization params
// List of supported params are available in passport-google-oauth2 source
// https://github.com/jaredhanson/passport-google-oauth2/blob/master/lib/strategy.js
// https://developers.google.com/identity/protocols/OpenIDConnect#authenticationuriparameters
googleAuthorizationParams: {
scope: ['profile', 'email'],
hostedDomain: 'reaktor.fi',
// To gain refreshable tokens
accessType: 'offline',
// This forces Google to send refresh tokens on each session start
// By default Google sends refresh token only once per authentication to Google
prompt: 'consent'
},
// Time in seconds to refresh access token before it expires
refreshBefore: 10
// Redirect user to the original url
returnToOriginalUrl: false,
// originalUrl will be set as the return url only if returnToOriginalUrl is true,
// and the originalUrl passes this predicate
isReturnUrlAllowed: url => /\.(css|jpe?g|gif|ico|js|json|png|svg|woff2?)$/i.test(url) === false,
})
FAQs
Simplified GAuth login for Express with ACLs
The npm package @reaktor/express-gauth receives a total of 1 weekly downloads. As such, @reaktor/express-gauth popularity was classified as not popular.
We found that @reaktor/express-gauth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.
Security News
PyPI now supports digital attestations, enhancing security and trust by allowing package maintainers to verify the authenticity of Python packages.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.