idtoken-verifier

What is idtoken-verifier?

The idtoken-verifier npm package is used to verify ID tokens, typically in the context of authentication and authorization. It helps ensure that the tokens are valid, properly signed, and not tampered with.

What are idtoken-verifier's main functionalities?

Verify ID Token

This feature allows you to verify the validity of an ID token. You need to provide the issuer and audience information, and then use the `verify` method to check the token. If the token is valid, the payload is returned; otherwise, an error is provided.

const IdTokenVerifier = require('idtoken-verifier');

const verifier = new IdTokenVerifier({
  issuer: 'https://your-issuer.com/',
  audience: 'your-audience'
});

const token = 'your-id-token';

verifier.verify(token, (err, payload) => {
  if (err) {
    console.error('Token verification failed:', err);
  } else {
    console.log('Token is valid. Payload:', payload);
  }
});

Decode ID Token

This feature allows you to decode an ID token without verifying it. The `decode` method returns the decoded token, which can be useful for inspecting the token's contents.

const IdTokenVerifier = require('idtoken-verifier');

const token = 'your-id-token';

const decoded = IdTokenVerifier.decode(token);
console.log('Decoded token:', decoded);

Other packages similar to idtoken-verifier

jsonwebtoken

The jsonwebtoken package is a popular library for working with JSON Web Tokens (JWTs). It provides functionalities for signing, verifying, and decoding tokens. Compared to idtoken-verifier, jsonwebtoken offers a broader range of features for handling JWTs, including token creation.

jose

The jose package is a comprehensive library for JSON Web Algorithms (JWA), JSON Web Keys (JWK), JSON Web Signatures (JWS), and JSON Web Encryption (JWE). It provides extensive support for various cryptographic operations related to JWTs. While idtoken-verifier focuses on verifying ID tokens, jose offers a more extensive set of tools for working with JWTs and related standards.

passport-jwt

The passport-jwt package is a Passport strategy for authenticating with JSON Web Tokens. It is used in conjunction with the Passport authentication middleware for Node.js. This package is more focused on integrating JWT authentication into web applications, whereas idtoken-verifier is specifically for verifying ID tokens.

README

A lightweight library to decode and verify RSA ID tokens meant for the browser.

:books: Documentation - :rocket: Getting Started - :computer: API Reference - :speech_balloon: Feedback

Documentation

• API Reference
• Docs Site - explore our Docs site and learn more about Auth0

Getting Started

Installation

Using npm in your project directory run the following command:

npm install idtoken-verifier

Verify an ID token

Import the library, create an instance of IdTokenVerifier and call the verify method to verify an ID token:

import IdTokenVerifier from 'idtoken-verifier';

const verifier = new IdTokenVerifier({
  issuer: 'https://my.auth0.com/',
  audience: 'gYSNlU4YC4V1YPdqq8zPQcup6rJw1Mbt'
});

verifier.verify(id_token, nonce, (error, payload) => {
  if (error) {
    // handle the error
    return;
  }

  // do something with `payload`
});

API Reference

• IdTokenVerifier constructor
• verify
• decode
• validateAccessToken

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

• Auth0's general contribution guidelines
• Auth0's code of conduct guidelines
• The contribution guide

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability Reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

What is Auth0?

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?

This project is licensed under the Apache 2.0 license. See the LICENSE file for more info.

Changelog

v2.2.4 (2023-10-26)

Full Changelog

Security

• Bump crypto-js from 4.1.1 to 4.2.0 #176 (dependabot[bot])