oauth2-server

What is oauth2-server?

The oauth2-server npm package is a complete, compliant, and well-tested module for implementing an OAuth2 server in Node.js. It provides a framework for handling OAuth2 authorization and token requests, making it easier to secure APIs and manage user authentication.

What are oauth2-server's main functionalities?

Authorization Code Grant

This feature allows you to implement the Authorization Code Grant flow, which is one of the most common OAuth2 flows. The code sample demonstrates how to set up an endpoint to handle authorization requests.

const OAuth2Server = require('oauth2-server');
const Request = OAuth2Server.Request;
const Response = OAuth2Server.Response;

const oauth = new OAuth2Server({
  model: require('./model')
});

app.post('/authorize', (req, res) => {
  const request = new Request(req);
  const response = new Response(res);

  oauth.authorize(request, response)
    .then((authorizationCode) => {
      res.json(authorizationCode);
    }).catch((err) => {
      res.status(err.code || 500).json(err);
    });
});

Token Grant

This feature allows you to implement the Token Grant flow, which is used to exchange an authorization code for an access token. The code sample demonstrates how to set up an endpoint to handle token requests.

app.post('/token', (req, res) => {
  const request = new Request(req);
  const response = new Response(res);

  oauth.token(request, response)
    .then((token) => {
      res.json(token);
    }).catch((err) => {
      res.status(err.code || 500).json(err);
    });
});

Resource Server

This feature allows you to protect your API endpoints by requiring a valid access token. The code sample demonstrates how to set up an endpoint that requires authentication.

app.get('/secure', (req, res) => {
  const request = new Request(req);
  const response = new Response(res);

  oauth.authenticate(request, response)
    .then((token) => {
      res.json({ message: 'Secure data' });
    }).catch((err) => {
      res.status(err.code || 500).json(err);
    });
});

Other packages similar to oauth2-server

passport-oauth2

passport-oauth2 is a strategy for Passport, the popular authentication middleware for Node.js. It allows you to authenticate using OAuth2 in your applications. Compared to oauth2-server, passport-oauth2 is more focused on client-side authentication and integrating with third-party OAuth2 providers, whereas oauth2-server is designed for building your own OAuth2 server.

simple-oauth2

simple-oauth2 is a lightweight library for integrating OAuth2 in Node.js applications. It provides a simple API for obtaining access tokens and refreshing them. While simple-oauth2 is great for client-side OAuth2 flows, it does not provide the full server-side capabilities that oauth2-server offers.

node-oauth2-server

node-oauth2-server is another implementation of an OAuth2 server for Node.js. It is similar to oauth2-server in terms of functionality and API design. Both packages are designed to help you build a compliant OAuth2 server, but node-oauth2-server may have different design choices and community support.

README

Complete, compliant and well tested module for implementing an OAuth2 server in node.js.

Quick Start

The node-oauth2-server module is framework-agnostic but there are several wrappers available for popular frameworks such as express and koa 2.

Using the express wrapper (recommended):

var express = require('express');
var oauthServer = require('express-oauth-server');
var app = express();

var oauth = new oauthServer({ model: model });

app.use(oauth.authenticate());

app.get('/', function (req, res) {
  res.send('Hello World');
})

app.listen(3000);

Using this module directly (for custom servers only):

var Request = require('oauth2-server').Request;
var oauthServer = require('oauth2-server');

var oauth = new oauthServer({ model: model });

var request = new Request({
  headers: { authorization: 'Bearer foobar' }
});

oauth.authenticate(request)
  .then(function(data) {
    // Request is authorized.
  })
  .catch(function(e) {
    // Request is not authorized.
  });

Note: see the documentation for the specification of what's required from the model.

Features

• Supports authorization_code (with scopes), client_credentials, password, refresh_token and custom extension grant types.
• Can be used with node-style callbacks, promises and ES6 async/await.
• Fully RFC6749 and RFC6750 compliant.
• Implicitly supports any form of storage e.g. PostgreSQL, MySQL, Mongo, Redis, etc.
• Full test suite.

Documentation

• Server options
• Model specification
  • Authorization Code
  • Client Credentials
  • Password
  • Refresh token
  • Custom extension

Examples

Most users should refer to our express or koa examples. If you're implementing a custom server, we have many examples available:

• A simple password grant authorization example.
• A more complex password and refresh_token example.
• An advanced password, refresh_token and authorization_code (with scopes) example.

Upgrading from 2.x

This module has been rewritten with a promise-based approach and introduced a few changes in the model specification.

Please refer to our 3.0 migration guide for more information.

License

MIT