idtoken-verifier
Advanced tools
A lightweight library to decode and verify RS JWT meant for the browser.
The idtoken-verifier npm package is used to verify ID tokens, typically in the context of authentication and authorization. It helps ensure that the tokens are valid, properly signed, and not tampered with.
Verify ID Token
This feature allows you to verify the validity of an ID token. You need to provide the issuer and audience information, and then use the `verify` method to check the token. If the token is valid, the payload is returned; otherwise, an error is provided.
const IdTokenVerifier = require('idtoken-verifier');
const verifier = new IdTokenVerifier({
issuer: 'https://your-issuer.com/',
audience: 'your-audience'
});
const token = 'your-id-token';
verifier.verify(token, (err, payload) => {
if (err) {
console.error('Token verification failed:', err);
} else {
console.log('Token is valid. Payload:', payload);
}
});Decode ID Token
This feature allows you to decode an ID token without verifying it. The `decode` method returns the decoded token, which can be useful for inspecting the token's contents.
const IdTokenVerifier = require('idtoken-verifier');
const token = 'your-id-token';
const decoded = IdTokenVerifier.decode(token);
console.log('Decoded token:', decoded);The jsonwebtoken package is a popular library for working with JSON Web Tokens (JWTs). It provides functionalities for signing, verifying, and decoding tokens. Compared to idtoken-verifier, jsonwebtoken offers a broader range of features for handling JWTs, including token creation.
The jose package is a comprehensive library for JSON Web Algorithms (JWA), JSON Web Keys (JWK), JSON Web Signatures (JWS), and JSON Web Encryption (JWE). It provides extensive support for various cryptographic operations related to JWTs. While idtoken-verifier focuses on verifying ID tokens, jose offers a more extensive set of tools for working with JWTs and related standards.
The passport-jwt package is a Passport strategy for authenticating with JSON Web Tokens. It is used in conjunction with the Passport authentication middleware for Node.js. This package is more focused on integrating JWT authentication into web applications, whereas idtoken-verifier is specifically for verifying ID tokens.
A lightweight library to decode and verify RSA ID tokens meant for the browser.
:books: Documentation - :rocket: Getting Started - :computer: API Reference - :speech_balloon: Feedback
Using npm in your project directory run the following command:
npm install idtoken-verifier
Import the library, create an instance of IdTokenVerifier and call the verify method to verify an ID token:
import IdTokenVerifier from 'idtoken-verifier';
const verifier = new IdTokenVerifier({
issuer: 'https://my.auth0.com/',
audience: 'gYSNlU4YC4V1YPdqq8zPQcup6rJw1Mbt'
});
verifier.verify(id_token, nonce, (error, payload) => {
if (error) {
// handle the error
return;
}
// do something with `payload`
});
We appreciate feedback and contribution to this repo! Before you get started, please see the following:
To provide feedback or report a bug, please raise an issue on our issue tracker.
Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?
This project is licensed under the Apache 2.0 license. See the LICENSE file for more info.
FAQs
A lightweight library to decode and verify RS JWT meant for the browser.
The npm package idtoken-verifier receives a total of 177,593 weekly downloads. As such, idtoken-verifier popularity was classified as popular.
We found that idtoken-verifier demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 47 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.
Security News
PyPI now supports digital attestations, enhancing security and trust by allowing package maintainers to verify the authenticity of Python packages.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.