express-openid-connect
Advanced tools
Express middleware to protect web applications using OpenID Connect.
Express JS middleware implementing sign on for Express web apps using OpenID Connect.
Node.js version >=12.0.0 is recommended, but ^10.19.0 lts/dubnium is also supported.
npm install express-openid-connect
Follow our Secure Local Development guide to ensure that applications using this library are running over secure channels (HTTPS URLs). Applications using this library without HTTPS may experience "invalid state" errors.
The library needs issuerBaseURL, baseURL, clientID and secret to request and accept authentication. These can be configured with environmental variables:
ISSUER_BASE_URL=https://YOUR_DOMAIN
CLIENT_ID=YOUR_CLIENT_ID
BASE_URL=https://YOUR_APPLICATION_ROOT_URL
SECRET=LONG_RANDOM_VALUE
... or in the library initialization:
// index.js
const { auth } = require('express-openid-connect');
app.use(
auth({
issuerBaseURL: 'https://YOUR_DOMAIN',
baseURL: 'https://YOUR_APPLICATION_ROOT_URL',
clientID: 'YOUR_CLIENT_ID',
secret: 'LONG_RANDOM_STRING',
idpLogout: true,
})
);
With this basic configuration, your application will require authentication for all routes and store the user identity in an encrypted and signed cookie.
See the examples for route-specific authentication, custom application session handling, requesting and using access tokens for external APIs, and more.
See the API documentation for additional configuration possibilities and provided methods.
Errors raised by this library are handled by the default Express error handler which, in the interests of security, does not include the stack trace or error message in the production environment. If you write your own error handler, you should not render the error message without using a templating engine that will properly escape it first.
To write your own error handler, see the Express documentation on writing Custom error handlers.
We appreciate feedback and contribution to this repo! Before you get started, please see the following:
Contributions can be made to this library through PRs to fix issues, improve documentation or add features. Please fork this repo, create a well-named branch, and submit a PR with a complete template filled out.
Code changes in PRs should be accompanied by tests covering the changed or added functionality. Tests can be run for this library with:
npm install
npm test
When you're ready to push your changes, please run the lint command first:
npm run lint
Please use the Issues queue in this repo for questions and feedback.
Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
Auth0 helps you to easily:
This project is licensed under the MIT license. See the LICENSE file for more info.
FAQs
Express middleware to protect web applications using OpenID Connect.
The npm package express-openid-connect receives a total of 59,494 weekly downloads. As such, express-openid-connect popularity was classified as popular.
We found that express-openid-connect demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 45 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
Research
Security News
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
Security News
The UK is proposing a bold ban on ransomware payments by public entities to disrupt cybercrime, protect critical services, and lead global cybersecurity efforts.