Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
apple-auth
Advanced tools
An easy-to-use Node.js library for Signing in with Apple!
Now with support for fetching the name and email!
⚠️ Important note: Apple will only provide you with the name ONCE which is when the user taps "Sign in with Apple" on your app the first time. Keep in mind that you have to store this in your database at this time! For every login after that, Apple will provide you with a unique ID and the email that you can use to lookup the username in your database.
Check out the passport version of this library here:
https://github.com/ananay/passport-apple
https://npmjs.com/package/passport-apple
Begin by installing the library:
npm install apple-auth
The configurations for Sign in with Apple are quite extensive so I've made an extensive SETUP.md file that you can read https://github.com/ananay/apple-auth/blob/master/SETUP.md
I've created an example of how to use this library with Express! Check it out here:
https://github.com/ananay/apple-auth-example
Example live on https://apple.ananay.dev
Initialize it using the following code:
const fs = require('fs');
const AppleAuth = require('apple-auth');
const config = fs.readFileSync("./config/config");
const auth = new AppleAuth(config, './config/AuthKey.p8');
Methods:
auth.loginURL()
- Creates the Login URL that your users will use to login toauth.accessToken(grantCode)
- Gets the access token from the grant code receivedauth.refreshToken(refreshToken)
- Gets the access token from a refresh tokeninvalid_grant
when authorization code is generated by iOS AppFix: If the authorizationCode was generated by your app, you should use your App ID as your clientId and not your service one. Discussion: https://github.com/ananay/apple-auth/issues/13
Feel free to open issues and pull requests. If you would like to be one of the core creators of this library, please reach out to me at i@ananayarora.com or message me on twitter @ananayarora!
This repository is NOT developed, endorsed by Apple Inc. or even related at all to Apple Inc. This library was implemented solely by the community's hardwork, and based on information that is public on Apple Developer's website. The library is a helper library for anyone trying to implement Apple's Sign in with Apple.
FAQs
Sign in with Apple for NodeJS
The npm package apple-auth receives a total of 4,643 weekly downloads. As such, apple-auth popularity was classified as popular.
We found that apple-auth demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.