@criipto/verify-express
v1.0.3
Published
Accept MitID, NemID, Swedish BankID, Norwegian BankID and more logins in your Node.js app using Passport or plain Express.js
Downloads
5,072
Readme
criipto-verify-express
Accept MitID, NemID, Swedish BankID, Norwegian BankID and more logins in your Node.js app using Passport or plain Express.js
Installation
Using npm
npm install @criipto/verify-express
Getting Started
You can find your domain and application client id on the Criipto Dashboard.
If you do not have your client secret stored anywhere, make sure to enable Code Flow and/or regenerate your client secret.
Below you will find examples for both Single-page application and Web-application use cases. You can also download a full sample from GitHub
Debugging
DEBUG=@criipto/verify-express*
Web-application with sessions and redirect.
Sessions must be setup when using redirect based authentication.
You must also register a Callback URL on your Criipto Application matching the URL of your redirect handling route.
// server.js
const express = require('express');
const expressSesssion = require('express-session');
const app = express();
app.use(
expressSesssion({
secret: '{{YOUR_SESSION_SECRET}}',
resave: false,
saveUninitialized: true
})
);
Passport
// server.js
app.use(passport.initialize());
app.use(passport.session());
passport.serializeUser(function(user, done) {
done(null, user);
});
passport.deserializeUser(function(user, done) {
done(null, user);
});
const redirectPassport = new CriiptoVerifyRedirectPassportStrategy(
{
domain: "{{YOUR_CRIIPTO_DOMAIN}}",
clientID: "{{YOUR_CLIENT_ID}}",
clientSecret: CRIIPTO_CLIENT_SECRET,
// Should match an express route that is an allowed callback URL in your application
// This route should also have the authentication middleware applied.
redirectUri: '/login',
postLogoutRedirectUri: '/',
// Ammend authorize request if you wish
beforeAuthorize(req, options) {
return {
...options,
acr_values: req.query.acr_values,
prompt: req.query.prompt
}
}
},
// Map claims to an express user
async (jwtClaims) => {
return jwtClaims;
}
);
// Route to both trigger and handle redirect
app.get('/login', passport.authenticate('criiptoVerifyRedirect', {failureRedirect: '/error', successReturnToOrRedirect: '/passport/protected'}), (req, res) => {
res.json(req.user);
});
app.get('/protected', passport.authenticate('criiptoVerifyRedirect', {}), (req, res) => {
res.json(req.user);
});
app.get('/logout', redirectPassport.logout.bind(redirectPassport));
app.get('/error', function (req, res, next) {
res.json({
error: req.query.error,
error_description: req.query.error_description,
});
});
Plain express
const expressRedirect = new CriiptoVerifyExpressRedirect({
domain: "{{YOUR_CRIIPTO_DOMAIN}}",
clientID: "{{YOUR_CLIENT_ID}}",
clientSecret: CRIIPTO_CLIENT_SECRET,
// Should match an express route that is an allowed callback URL in your application
// This route should also have the authentication middleware applied.
redirectUri: '/login',
postLogoutRedirectUri: '/',
// Ammend authorize request if you wish
beforeAuthorize(req, options) {
return {
...options,
acr_values: req.query.acr_values,
prompt: req.query.prompt
}
}
});
// Route to both trigger and handle redirect
app.get('/login', expressRedirect.middleware({failureRedirect: '/error', successReturnToOrRedirect: '/plain/protected'}), (req, res) => {
res.json(req.claims);
});
app.get('/protected', expressRedirect.middleware({}), (req, res) => {
res.json(req.claims);
});
app.get('/logout', expressRedirect.logout.bind(expressRedirect));
app.get('/error', function (req, res, next) {
res.json({
error: req.query.error,
error_description: req.query.error_description,
});
});
Single-page application
SPAs can utilize frontend frameworks like @criipto/auth-js or @criipto/verify-react to handle the login in the frontend and then send a Bearer token to their API.
You must register a Callback URL on your Criipto Application matching the href
of the URL you are triggering SPA login from.
Passport
// server.js
const express = require('express');
const passport = require('passport');
const CriiptoVerifyJwtPassportStrategy = require('@criipto/verify-express').CriiptoVerifyJwtPassportStrategy;
const app = express();
app.use(passport.initialize());
passport.serializeUser(function(user, done) {
done(null, user);
});
passport.deserializeUser(function(user, done) {
done(null, user);
});
passport.use(
'criiptoVerifyJwt',
new CriiptoVerifyJwtPassportStrategy({
domain: "{{YOUR_CRIIPTO_DOMAIN}}",
clientID: "{{YOUR_CLIENT_ID}}"
},
// Map claims to an express user
async (jwtClaims) => {
return jwtClaims;
})
);
app.get('/jwt-protected-route', passport.authenticate('criiptoVerifyJwt', { session: false }), (req, res) => {
res.json({
...req.user,
passport: 'says hi'
});
});
// client.js
const {id_token} = login();
fetch(`{server}/jwt-protected-route`, {
headers: {
Authorization: `Bearer ${id_token}`
}
})
Plain express
// server.js
const express = require('express');
const CriiptoVerifyExpressJwt = require('@criipto/verify-express').CriiptoVerifyExpressJwt;
const app = express();
const expressJwt = new CriiptoVerifyExpressJwt({
domain: "{{YOUR_CRIIPTO_DOMAIN}}",
clientID: "{{YOUR_CLIENT_ID}}"
});
app.get('/jwt-protected-route', expressJwt.middleware(), (req, res) => {
res.json({
...req.user,
express: 'says hi'
});
});
// client.js
const {id_token} = login();
fetch(`{server}/jwt-protected-route`, {
headers: {
Authorization: `Bearer ${id_token}`
}
})