oauth

What is oauth?

The 'oauth' npm package is a library that allows developers to implement OAuth authentication in their Node.js applications. OAuth is an open standard for access delegation, commonly used to grant websites or applications access to user information on other websites without giving them the passwords. This package supports both OAuth 1.0A and OAuth 2.0 protocols.

What are oauth's main functionalities?

Creating an OAuth 1.0A client

This code sample demonstrates how to create an OAuth 1.0A client for interacting with a service like Twitter. It initializes the OAuth client with the necessary endpoints and credentials.

const OAuth = require('oauth').OAuth;
let oauth = new OAuth(
  'https://api.twitter.com/oauth/request_token',
  'https://api.twitter.com/oauth/access_token',
  'your_consumer_key',
  'your_consumer_secret',
  '1.0A',
  null,
  'HMAC-SHA1'
);

Signing OAuth 1.0A requests

This code sample shows how to sign OAuth 1.0A requests to access protected resources, such as a user's account information on Twitter. It uses the 'get' method of the OAuth client.

oauth.get(
  'https://api.twitter.com/1.1/account/verify_credentials.json',
  'your_access_token', // user token
  'your_token_secret', // user secret
  function (e, data, res) {
    if (e) console.error(e);
    console.log(require('util').inspect(data));
  }
);

Creating an OAuth 2.0 client

This code sample demonstrates how to create an OAuth 2.0 client for interacting with a service like Google. It initializes the OAuth2 client with the necessary endpoints and credentials.

const OAuth2 = require('oauth').OAuth2;
let oauth2 = new OAuth2(
  'your_client_id',
  'your_client_secret',
  '',
  'https://accounts.google.com/o/oauth2/auth',
  'https://accounts.google.com/o/oauth2/token',
  null
);

Getting OAuth 2.0 access token

This code sample shows how to get an OAuth 2.0 access token using the client credentials grant type. The access token can then be used to authenticate API requests.

oauth2.getOAuthAccessToken(
  '',
  {'grant_type':'client_credentials'},
  function (e, access_token, refresh_token, results){
    console.log('bearer: ',access_token);
  }
);

Other packages similar to oauth

passport

Passport is a popular authentication middleware for Node.js. Unlike 'oauth', which is specifically focused on OAuth protocols, Passport supports a wide range of authentication strategies, including OAuth, OpenID, and others. It is designed to be plugged into any Express-based web application.

simple-oauth2

Simple OAuth2 is a simplified, modular library for interacting with OAuth2 providers. It abstracts away some of the complexities of the OAuth 2.0 protocol. It's a higher-level library compared to 'oauth' and provides a more straightforward API for handling tokens and making authenticated requests.

grant

Grant is a middleware for Express, Koa, and Hapi that is designed to help you add OAuth integration to your application. It supports more than 180 providers out of the box and has a simpler configuration compared to 'oauth'. It's a good choice for those who want to support multiple OAuth providers with minimal setup.

README

node-oauth

A simple oauth API for node.js . This API allows users to authenticate against OAUTH providers, and thus act as OAuth consumers

Tested against both Twitter (http://twitter.com), term.ie (http://term.ie/oauth/example/) and Yahoo!

Also provides rudimentary OAuth2 support, tested against facebook connect and github. For more complete usage examples please take a look at connect-auth (http://github.com/ciaranj/connect-auth)

Change History

• 0.8.4 - Fixed issue #14 (Parameter ordering ignored encodings). Added support for repeated parameter names. Implements issue #15 (Use native SHA1 if available, 10x speed improvement!). Fixed issue #16 (Should use POST when requesting access tokens.). Fixed Issue #17 (OAuth2 spec compliance). Implemented enhancement #13 (Adds support for PUT & DELETE http verbs). Fixes issue #18 (Complex/Composite url arguments [thanks novemberborn])
• 0.8.3 - Fixed an issue where the auth header code depended on the Array's toString method (Yohei Sasaki) Updated the getOAuthRequestToken method so we can access google's OAuth secured methods. Also re-implemented and fleshed out the test suite.
• 0.8.2 - The request returning methods will now write the POST body if provided (Chris Anderson), the code responsible for manipulating the headers is a bit safe now when working with other code (Paul McKellar) and tweaked the package.json to use index.js instead of main.js
• 0.8.1 - Added mechanism to get hold of a signed Node Request object, ready for attaching response listeners etc. (Perfect for streaming APIs)
• 0.8.0 - Standardised method capitalisation, the old getOauthAccessToken is now getOAuthAccessToken (Breaking change to existing code)
• 0.7.7 - Looks like non oauth_ parameters where appearing within the Authorization headers, which I believe to be inccorrect.
• 0.7.6 - Added in oauth_verifier property to getAccessToken required for 1.0A
• 0.7.5 - Added in a main.js to simplify the require'ing of OAuth
• 0.7.4 - Minor change to add an error listener to the OAuth client (thanks troyk)
• 0.7.3 - OAuth 2 now sends a Content-Length Http header to keep nginx happy :)
• 0.7.2 - Fixes some broken unit tests!
• 0.7.0 - Introduces support for HTTPS end points and callback URLS for OAuth 1.0A and Oauth 2 (Please be aware that this was a breaking change to the constructor arguments order)

Contributors

• Ciaran Jessup - [e-mail]
• Mark Wubben - http://equalmedia.com/