Security News
ESLint is Now Language-Agnostic: Linting JSON, Markdown, and Beyond
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
auth0-js
Advanced tools
The auth0-js package is a JavaScript client library for integrating Auth0 authentication and authorization services into web applications. It provides a variety of methods for handling user authentication, managing user sessions, and interacting with Auth0's API.
User Authentication
This feature allows you to authenticate users by redirecting them to the Auth0 login page. The code sample demonstrates how to initialize the Auth0 client and trigger the authentication process.
const auth0 = new auth0.WebAuth({
domain: 'YOUR_AUTH0_DOMAIN',
clientID: 'YOUR_CLIENT_ID'
});
auth0.authorize({
redirectUri: 'YOUR_CALLBACK_URL',
responseType: 'token id_token',
scope: 'openid profile email'
});
Handling Authentication Callback
This feature handles the authentication callback after the user has logged in. The code sample shows how to parse the URL hash to extract authentication tokens.
auth0.parseHash((err, authResult) => {
if (authResult && authResult.accessToken && authResult.idToken) {
window.location.hash = '';
// Save the tokens in local storage or a cookie
} else if (err) {
console.error('Error parsing hash:', err);
}
});
User Logout
This feature allows you to log out users from the application. The code sample demonstrates how to trigger the logout process and redirect the user to a specified URL.
auth0.logout({
returnTo: 'YOUR_RETURN_URL',
clientID: 'YOUR_CLIENT_ID'
});
Silent Authentication
This feature allows you to silently authenticate users without redirecting them to the login page. The code sample shows how to check the user's session and obtain new tokens if needed.
auth0.checkSession({}, (err, authResult) => {
if (err) {
console.error('Error during silent authentication:', err);
} else {
// Use the authResult to get new tokens
}
});
Passport is a popular authentication middleware for Node.js. It provides a wide range of authentication strategies, including OAuth, OpenID, and more. Unlike auth0-js, which is specific to Auth0, Passport is more flexible and can be used with various authentication providers.
Firebase Authentication provides backend services for easy use of authentication in web and mobile apps. It supports various authentication methods like email/password, phone, and social providers. Compared to auth0-js, Firebase Authentication is part of the larger Firebase platform, offering more integrated services.
Client Side JavaScript toolkit for Auth0 API.
If you want to read the full API documentation of auth0.js, see here.
From CDN:
<!-- Latest patch release -->
<script src="https://cdn.auth0.com/js/auth0/9.19.1/auth0.min.js"></script>
From npm:
npm install auth0-js
After installing the auth0-js
module using npm, you'll need to bundle it up along with all of its dependencies, or import it using:
import auth0 from 'auth0-js';
Provides support for all the authentication flows.
var auth0 = new auth0.WebAuth({
domain: '{YOUR_AUTH0_DOMAIN}',
clientID: '{YOUR_AUTH0_CLIENT_ID}'
});
Parameters
All parameters can be considered optional unless otherwise stated.
Option | Type | Description |
---|---|---|
domain | string (required) | Your Auth0 account domain such as 'example.auth0.com' or 'example.eu.auth0.com' . |
clientID | string (required) | The Client ID found on your Application settings page. |
redirectUri | string | The URL where Auth0 will call back to with the result of a successful or failed authentication. It must be added to the "Allowed Callback URLs" in your Auth0 Application's settings. |
scope | string | The default scope used for all authorization requests. |
audience | string | The default audience, used if requesting access to an API. |
responseType | string | Response type for all authentication requests. It can be any space separated list of the values code , token , id_token . If you don't provide a global responseType , you will have to provide a responseType for each method that you use. |
responseMode | string | The default responseMode used, defaults to 'fragment' . The parseHash method can be used to parse authentication responses using fragment response mode. Supported values are query , fragment and form_post . The query value is only supported when responseType is code . |
_disableDeprecationWarnings | boolean | Indicates if deprecation warnings should be output to the browser console, defaults to false . |
maxAge | number | Used during token validation. Specifies the maximum elapsed time in seconds since the last time the user was actively authenticated by the authorization server. If the elapsed time is greater than this value, the token is considered invalid and the user must be re-authenticated. |
leeway | number | Used during ID token validation. Specifies the number of seconds to account for clock skew when validating time-based claims such as iat and exp . The default is 60 seconds. |
organization | string | The ID of the Organization to log in to (see Organizations) |
invitation | string | The ID of the user invitation to accept. This is usually used in conjunction with the organization parameter, and should be parsed from an invitation URL. (see Organizations) |
Redirects to the /authorize
endpoint to start an authentication/authorization transaction. Auth0 will call back to your application with the results at the specified redirectUri
.
Note: The default scope for this method is openid profile email
.
auth0.authorize({
audience: 'https://mystore.com/api/v2',
scope: 'read:order write:order',
responseType: 'token',
redirectUri: 'https://example.com/auth/callback'
});
Parses a URL hash fragment to extract the result of an Auth0 authentication response.
Note: This method requires that your tokens are signed with RS256 - please read our documentation on signing algorithms for more information.
auth0.parseHash({ hash: window.location.hash }, function (err, authResult) {
if (err) {
return console.log(err);
}
// The contents of authResult depend on which authentication parameters were used.
// It can include the following:
// authResult.accessToken - access token for the API specified by `audience`
// authResult.expiresIn - string with the access token's expiration time in seconds
// authResult.idToken - ID token JWT containing user profile information
auth0.client.userInfo(authResult.accessToken, function (err, user) {
// Now you have the user's information
});
});
Allows you to acquire a new token from Auth0 for a user who already has an SSO session established against Auth0 for your domain. If the user is not authenticated, the authentication result will be empty and you'll receive an error like this: {error: 'login_required'}
.The method accepts any valid OAuth2 parameters that would normally be sent to /authorize
.
Everything happens inside an iframe, so it will not reload your application or redirect away from it.
auth0.checkSession(
{
audience: 'https://mystore.com/api/v2',
scope: 'read:order write:order'
},
function (err, authResult) {
// Authentication tokens or error
}
);
The contents of authResult
are identical to those returned by parseHash()
.
Important: If you're not using the hosted login page to do social logins, you have to use your own social connection keys. If you use Auth0's dev keys, you'll always get login_required
as an error when calling checkSession
.
Important: Because there is no redirect in this method, responseType: 'code'
is not supported and will throw an error.
Remember to add the URL where the authorization request originates from to the Allowed Web Origins list of your Auth0 Application in the Dashboard under your Applications's Settings.
Authenticates a user with username and password in a realm using /oauth/token
. This will not initialize a SSO session at Auth0, hence can not be used along with silent authentication.
auth0.client.login(
{
realm: 'Username-Password-Authentication', //connection name or HRD domain
username: 'info@auth0.com',
password: 'areallystrongpassword',
audience: 'https://mystore.com/api/v2',
scope: 'read:order write:order'
},
function (err, authResult) {
// Auth tokens in the result or an error
}
);
The contents of authResult
are identical to those returned by parseHash()
.
onRedirecting hook
When using login
to log in using a username and password, Auth0.js initially makes a call to Auth0 to get a login ticket, before sending that login ticket to the /authorize
endpoint to be exchanged for tokens. You are able to specify an onRedirecting
hook here to handle when Auth0.js is about to redirect to the /authorize
endpoint, for the purposes of executing some custom code (analytics, etc).
To do this, specify the onRedirecting
function in the options and ensure that the done
callback is called when you are finished executing your custom code. Otherwise, authentication will be blocked.
auth0.client.login(
{
realm: 'Username-Password-Authentication', //connection name or HRD domain
username: 'info@auth0.com',
password: 'areallystrongpassword',
onRedirecting: function (done) {
// Your custom code here
done();
}
},
function (err, authResult) {
// Auth tokens in the result or an error
}
);
Provides an API client for the Auth0 Authentication API.
var auth0 = new auth0.Authentication({
domain: '{YOUR_AUTH0_DOMAIN}',
clientID: '{YOUR_AUTH0_CLIENT_ID}'
});
Builds and returns the /authorize
url in order to initialize a new authN/authZ transaction. https://auth0.com/docs/api/authentication#database-ad-ldap-passive-
Builds and returns the Logout url in order to initialize a new authN/authZ transaction. https://auth0.com/docs/api/authentication#logout
Makes a call to the oauth/token
endpoint with password
grant type. https://auth0.com/docs/api-auth/grant/password
Makes a call to the oauth/token
endpoint with https://auth0.com/oauth/grant-type/password-realm
grant type.
Makes a call to the oauth/token
endpoint.
Makes a call to the /userinfo
endpoint and returns the user profile.
Provides an API Client for the Auth0 Management API (only methods meant to be used from the client with the user token). You should use an access_token
with the https://YOUR_DOMAIN.auth0.com/api/v2/
audience to make this work. For more information, read the user management section of the Auth0.js documentation.
For information on how to implement Passwordless Login with this SDK, please read Passwordless Login on Auth0 Docs.
var auth0 = new auth0.Management({
domain: '{YOUR_AUTH0_DOMAIN}',
token: '{ACCESS_TOKEN_FROM_THE_USER}'
});
Organizations is a set of features that provide better support for developers who build and maintain SaaS and Business-to-Business (B2B) applications.
To log in to a specific organization, pass the ID of the organization as the organization
parameter when creating the WebAuth
client:
var webAuth = new WebAuth({
domain: '{YOUR_AUTH0_DOMAIN}',
clientID: '{YOUR_AUTH0_CLIENT_ID}',
organization: '{YOUR_AUTH0_ORGANIZATION_ID}'
});
You can also specify an organization when calling authorize
:
webAuth.authorize({
organization: '{YOUR_AUTH0_ORGANIZATION_ID}'
});
Accept a user invitation through the SDK by creating a route within your application that can handle the user invitation URL, and log the user in by passing the organization
and invitation
parameters from this URL. You can either use authorize
or popup.authorize
as needed.
var url = new URL(invitationUrl)
var params = new URLSearchParams(url.search);
if (organization && invitation) {
webAuth.authorize({
organization: params.get('organization')
invitation: params.get('invitation')
});
}
For a complete reference and examples please check our docs.
Run npm install
to set up the environment.
Run npm start
to point your browser to https://localhost:3000/
to verify the example page works.
Run npm test
to run the test suite.
Run npm run ci:test
to run the tests that ci runs.
Run npm run test:watch
to run the test suite while you work.
Run npm run test:coverage
to run the test suite with coverage report.
Run npm run lint
to run the linter and check code styles.
Run npm install && npm run build && npm run test:es-check:es5 && npm run test:es-check:es2015:module
to check for JS incompatibility.
See .circleci/config.yml for additional checks that might be run as part of circleci integration tests.
If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
For auth0 related questions/support please use the Support Center.
This project is licensed under the MIT license. See the LICENSE file for more info.
v9.19.1 (2022-09-09)
Changed
Security
FAQs
Auth0 headless browser sdk
The npm package auth0-js receives a total of 148,470 weekly downloads. As such, auth0-js popularity was classified as popular.
We found that auth0-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 49 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
Security News
Members Hub is conducting large-scale campaigns to artificially boost Discord server metrics, undermining community trust and platform integrity.
Security News
NIST has failed to meet its self-imposed deadline of clearing the NVD's backlog by the end of the fiscal year. Meanwhile, CVE's awaiting analysis have increased by 33% since June.