oauth-libre
Advanced tools
Library for interacting with OAuth 1.0, 1.0A, 2 and Echo. Provides simplified client access and allows for construction of more complex apis and OAuth providers. Licensed under the GNU GPL version 3 or later.
A simple oauth API for node.js . This API allows users to authenticate against OAUTH providers, and thus act as OAuth consumers. It also has support for OAuth Echo, which is used for communicating with 3rd party media providers such as TwitPic and yFrog.
Tested against Twitter (http://twitter.com), term.ie (http://term.ie/oauth/example/), TwitPic, and Yahoo!
Also provides rudimentary OAuth2 support, tested against facebook, github, foursquare, google and Janrain. For more complete usage examples please take a look at connect-auth (http://github.com/ciaranj/connect-auth)
This code is covered under the GNU GPL version 3 or later with parts of the code also covered by the MIT license.
If you modify the code in this project, your changes will be under the GNU GPL version 3 or later.
If you go to the original project and modify the code there, your changes will be under the MIT license.
Note: if you submit patches to the original project and they are applied here, I will assume that they are under the MIT license. But someone else will have to go through the work to extract them away from the GPLv3 bits if they want to use them in a proprietary project
npm install oauth-libre
Requires JSDoc to be installed:
npm run build-docs
Using promises is optional.
Install the bluebird promises library:
npm install bluebird
An example of using oauth-libre with OAuth2 and Promises to access the Github API:
var OAuth2 = require('oauth-libre').PromiseOAuth2;
var clientId = '';
var clientSecret = '';
// Fill these in:
var user = 'USER';
var personalAccessToken = 'PERSONAL_ACCESS_TOKEN';
var baseSiteUrl = 'https://' + user + ':' + personalAccessToken + '@api.github.com/';
var authorizePath = 'oauth2/authorize';
var accessTokenPath = 'oauth2/access_token';
var customHeaders = null;
var oauth2 = new OAuth2(
clientId, clientSecret, baseSiteUrl, authorizePath, accessTokenPath, customHeaders
);
var url = 'https://api.github.com/users/' + user + '/received_events';
oauth2
.get(url, personalAccessToken)
.then(jsonParse)
.then(function(json) {
for (var i = 0; i < json.length; i += 1) {
console.log(json[i]['id'] + ': ' + json[i].type);
}
})
.catch(function(err) {
console.log('Error: ' + err);
});
function jsonParse(data) {
return JSON.parse(data);
}
Note that in the first line you must explicitly import OAuth2 with promises.
Example of using OAuth 1.0 with the Twitter API.
describe('OAuth1.0',function(){
var OAuth = require('oauth-libre');
it('tests trends Twitter API v1.1',function(done){
var oauth = new OAuth.OAuth(
'https://api.twitter.com/oauth/request_token',
'https://api.twitter.com/oauth/access_token',
'your application consumer key',
'your application secret',
'1.0A',
null,
'HMAC-SHA1'
);
oauth.setDefaultContentType('application/json');
oauth.get(
'https://api.twitter.com/1.1/trends/place.json?id=23424977',
'your user token for this app', //test user token
'your user secret for this app', //test user secret
function (e, data, res){
if (e) console.error(e);
console.log(require('util').inspect(data));
done();
});
});
});
var OAuth2 = require('oauth-libre').OAuth2;
console.log("Login here to get an authorization code: " + oauth2.getAuthorizeUrl());
var oauth2 = new OAuth2(
"client_id", // client id
"client_secret", // client secret
"http://localhost:3000/", // base site url
null, // authorize path
"/oauth/token", // access token path
null // custom headers object
);
oauth2.getOAuthAccessToken(
"auth_code",
{
"grant_type": "authorization_code",
"redirect_uri": "http://example.com/redirect_uri"
},
function(error, accessToken, refreshToken, results) {
if (error) {
console.log("Error: " + error);
} else {
console.log("Results: " + results);
}
}
);
OAuth 2.0 implements hooks for every request before and after it is executed. We're using the EventEmitter Node.js class to implement this.
This event is emitted before the HTTP (or HTTPS) request is executed. At this point we can modify the information in the request, such as the headers and POST data. Also we are given a done function because this event blocks request execution and we need to specify when to resume the current process.
Let's see an example:
oa2.on('request:before', (options, postBody, done) => {
// here you can add anything you want to the request before execution
// can add new headers or add new data to body.
//
// NOTE: you must call done and send 3 parameters without exception.
// The 3rd parameter must to be true if you want to execute request
// immediately.
done(options, postBody, true);
});
You must call done(modifiedOptions, modifiedPostBody, shouldExecute) always. The shouldExecute parameter exists because if we have more listeners for the request:before event we want to make sure all of the listeners are able to receive the event. The request should execute only once, that's why we have this parameter to tell event that we want to execute the request immediately.
This event is emitted after the request has been executed, we receive information about status and body of the response.
oa2.on('request:after', (status, response) => {
console.log('Status :' + JSON.stringify(status));
console.log('Response : ' + JSON.stringify(response));
});
describe('OAuth2',function() {
var OAuth = require('oauth-libre');
it('gets bearer token', function(done){
var OAuth2 = OAuth.OAuth2;
var twitterConsumerKey = 'your key';
var twitterConsumerSecret = 'your secret';
var oauth2 = new OAuth2(server.config.keys.twitter.consumerKey,
twitterConsumerSecret,
'https://api.twitter.com/',
null,
'oauth2/token',
null);
oauth2.getOAuthAccessToken(
'',
{'grant_type':'client_credentials'},
function (e, access_token, refresh_token, results){
console.log('bearer: ',access_token);
done();
});
});
Included with the source code are examples of using a web-based interface to login with:
examples/github-example.jsexamples/github-oauth2-authentication.jsexamples/twitter-example.jsThe Google example was removed due to the need for a custom Google-specific OAuth2 library for authentication.
http://localhost:8080/codeexamples/github-example.js where it says clientIDexamples/github-example.js where it says clientSecretnode examples/github-example.jshttp://localhost:8080/http://localhost:8080/code and should see the access token, on the command-line you will see something like "Obtained access_token: ..."http://localhost:3000/github/callback const clientId = 'YOURCLIENTID';
const clientSecret = 'YOURCLIENTSECRET';
const scope = 'user';
const redirectUrl = 'http://localhost:' + port + '/github/callback';
const baseUrl = 'https://github.com';
const authorizeUrl = '/login/oauth/authorize';
const tokenUrl = '/login/oauth/access_token';
node examples/github-oauth2-authentication.jshttp://localhost:3000/http://localhost:8080/github/callback and that's it.Note: This example has been removed because Google needs a custom OAuth2 client library: https://github.com/google/google-auth-library-nodejs
http://127.0.0.1:8080/callbackexamples/twitter-example.js where it says clientIDexamples/twitter-example.js where it says clientSecretnode examples/twitter-example.jshttp://localhost:8080/http://localhost:8080/code and should see some results from the response on the command-lineFAQs
Library for interacting with OAuth 1.0, 1.0A, 2 and Echo. Provides simplified client access and allows for construction of more complex apis and OAuth providers. Licensed under the GNU GPL version 3 or later.
We found that oauth-libre demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket Fix 2.0 brings targeted CVE remediation, smarter upgrade planning, and broader ecosystem support to help developers get to zero alerts.
Security News
Socket CEO Feross Aboukhadijeh joins Risky Business Weekly to unpack recent npm phishing attacks, their limited impact, and the risks if attackers get smarter.
Product
Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.