
Security News
Deno 2.2 Improves Dependency Management and Expands Node.js Compatibility
Deno 2.2 enhances Node.js compatibility, improves dependency management, adds OpenTelemetry support, and expands linting and task automation for developers.
express-oauth2-jwt-bearer
Advanced tools
Authentication middleware for Express.js that validates JWT bearer access tokens.
Authentication middleware for Express.js that validates JWT Bearer Access Tokens.
Note: This library is currently in Beta status and has not had a complete security review. We do not recommend using this library in production yet. As we move towards general availability, please be aware that releases may contain breaking changes. We will be monitoring the Issues queue here for feedback and questions. PRs and comments on existing PRs are welcome!
This package supports Node ^12.19.0 || ^14.15.0
npm install express-oauth2-jwt-bearer
The library requires issuerBaseURL and audience, which can be configured with environmental variables:
ISSUER_BASE_URL=https://YOUR_DOMAIN
AUDIENCE=https://my-api.com
const { auth } = require('express-oauth2-jwt-bearer');
app.use(auth());
... or in the library initialization:
const { auth } = require('express-oauth2-jwt-bearer');
app.use(
auth({
issuerBaseURL: 'https://YOUR_DOMAIN',
audience: 'https://my-api.com'
})
);
With this basic configuration, your api will require a valid Access Token JWT bearer token for all routes.
insufficient_scope
error if the value of the scope claim does not include all the given scopes.invalid_token
error if the value of the claim does not match.invalid_token
error if the value of the claim does not include all the given values.true
if the token is valid. Raises a 401 invalid_token
error if the function returns false
.const {
auth,
requiredScopes,
claimEquals,
claimIncludes,
claimCheck
} = require('express-oauth2-jwt-bearer');
// Initialise the auth middleware with environment variables and restrict
// access to your api to users with a valid Access Token JWT
app.use(auth());
// Restrict access to the messages api to users with the `read:msg`
// AND `write:msg` scopes
app.get('/api/messages',
requiredScopes('read:msg', 'write:msg'),
(req, res, next) => {
// ...
}
);
// Restrict access to the admin api to users with the `isAdmin: true` claim
app.get('/api/admin', claimEquals('isAdmin', true), (req, res, next) => {
// ...
});
// Restrict access to the managers admin api to users with both the role `admin`
// AND the role `manager`
app.get('/api/admin/managers',
claimIncludes('role', 'admin', 'manager'),
(req, res, next) => {
// ...
}
);
// Restrict access to the admin edit api to users with the `isAdmin: true` claim
// and the `editor` role.
app.get('/api/admin/edit',
claimCheck(({ isAdmin, roles }) => isAdmin && roles.includes('editor')),
(req, res, next) => {
// ...
}
);
Along with the other security best practices in the Express.js documentation, we recommend you use helmet in addition to this middleware which can help protect your app from some well-known web vulnerabilities by setting default security HTTP headers.
This SDK raises errors with err.status
and err.headers
according to rfc6750. The Express.js default error handler will set the error response with:
res.statusCode
set from err.status
res.statusMessage
set according to the status code.err.stack
.err.headers
object.The error_description
in the WWW-Authenticate
header will contain useful information about the error, which you may not want to disclose in Production.
See the Express.js docs on error handling for more information on writing custom error handlers.
Error: Cannot find module 'jose-node-cjs-runtime/jwks/remote'
when I run the SDKThis package takes a dependency on jose which uses package exports which requires Node ^12.19.0 || ^14.15.0
.
Even if you are using the correct version of Node, you may still run into this in some tooling that does not yet support package exports, like jest or Webpack 4.
To workaround this issue in jest, see how we use a custom resolver for this project.
See monorepo's contributing guidelines.
Please use the Issues queue in this repo for questions and feedback.
Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
Auth0 helps you to easily:
This project is licensed under the MIT license. See the LICENSE file for more info.
FAQs
Authentication middleware for Express.js that validates JWT bearer access tokens.
The npm package express-oauth2-jwt-bearer receives a total of 99,789 weekly downloads. As such, express-oauth2-jwt-bearer popularity was classified as popular.
We found that express-oauth2-jwt-bearer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 44 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Deno 2.2 enhances Node.js compatibility, improves dependency management, adds OpenTelemetry support, and expands linting and task automation for developers.
Security News
React's CRA deprecation announcement sparked community criticism over framework recommendations, leading to quick updates acknowledging build tools like Vite as valid alternatives.
Security News
Ransomware payment rates hit an all-time low in 2024 as law enforcement crackdowns, stronger defenses, and shifting policies make attacks riskier and less profitable.