Middleware to verify JSON-Web-Tokens (JWT) sent in Bearer Authorization Header.
If public-keys are required to verify JWTs the JWKS URI can be detected by
issuer using .well-known/openid-configuration URLs.
Supports multiple issuers with the jwks() method.
Works also with express using jwtAuthExpress().
Installation
npm i @veloze/jwt
In your code:
import { Server } from 'veloze'
import { jwtAuth } from '@veloze/jwt'
const server = new Server()
const issuer = 'https://my.oau.th'
// for HS256, HS384, HS512 token provide secret
const protect = jwtAuth({ issuer, secret: 's€cr3t' })
server.get('/', protect, (req, res) => res.end())
server.listen(443)
// ----
await fetch('https://server', {
headers: {
authorization: 'Bearer <TOKEN>' // H256 Token with issuer https://my.oau.th
}
})For OIDC servers with .well-known/openid-configuration
import { jwtAuth, jwks } from '@veloze/jwt'
const issuer = 'https://my.oau.th'
const issuer2 = 'https://oauth.other'
// supports multiple issuers
const secret = jwks([issuer, issuer2])
const protect = jwtAuth({ secret })import {
JWTHeaderParameters,
JWTPayload,
JWTVerifyOptions,
KeyLike
} from 'jose'
interface DecodedJWT {
header: JWTHeaderParameters,
payload: JWTPayload,
signature: string
}
type GetKeyLikeFn = (decodedToken: DecodedJWT, req: Request) => Promise<KeyLike>;
interface JwtOptions extends JWTVerifyOptions {
/**
* for HS256...HS512 provide secret as Buffer or string
* for asymmetric JWT provide publicKey as secret
*/
secret: string|Buffer|KeyLike|GetKeyLikeFn
/**
* if verification is successful then payload of decoded token is added to
* request using this property e.g. default is `req.auth`
* @default 'auth'
*/
requestProperty: string
}
function jwtAuth (options: JwtOptions):
Promise<(req: Request, res: Response): void>
function jwtAuthExpress (options: JwtOptions):
(req: Request, res: Response, next: Function): voidtype JwksOptions = {
/**
* allows to set custom fetch function
*/
fetcher?: typeof fetch | undefined;
/**
* expiry in ms, JWKS uris are cached until this expiry timeout
*/
expiresIn?: number | undefined;
/**
* jwksUri by issuer (for PS, RS, ES alg JWTs)
* allows to overwrite the default jwks_uri which usually is looked-up from
* .well-known/openid-configuration
*/
jwksByIssuer?: Record<string, string> | undefined;
/**
* secret by issuer (for HS JWTs)
*/
secretsByIssuer?: Record<string, string | Uint8Array> | undefined;
};
/**
* issuers: provide a list of different issuers which shall be supported
*/
function jwks(issuers: string[], options: JwksOptions): GetKeyLikeFn;MIT licensed
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent