npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

@passport-next/passport-oauth2

v2.1.4

Published

OAuth 2.0 authentication strategy for Passport.

Downloads

5,370

Readme

passport-oauth2

Build Status Coverage Status Maintainability Dependencies

General-purpose OAuth 2.0 authentication strategy for Passport.

This module lets you authenticate using OAuth 2.0 in your Node.js applications. By plugging into Passport, OAuth 2.0 authentication can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.

Note that this strategy provides generic OAuth 2.0 support. In many cases, a provider-specific strategy can be used instead, which cuts down on unnecessary configuration, and accommodates any provider-specific quirks. See the list for supported providers.

Developers who need to implement authentication against an OAuth 2.0 provider that is not already supported are encouraged to sub-class this strategy. If you choose to open source the new provider-specific strategy, please add it to the list so other people can find it.

Install

$ npm install @passport-next/passport-oauth2

Usage

Configure Strategy

The OAuth 2.0 authentication strategy authenticates users using a third-party account and OAuth 2.0 tokens. The provider's OAuth 2.0 endpoints, as well as the client identifer and secret, are specified as options. The strategy requires a verify callback, which receives an access token and profile, and calls cb providing a user.

passport.use(new OAuth2Strategy({
    authorizationURL: 'https://www.example.com/oauth2/authorize',
    tokenURL: 'https://www.example.com/oauth2/token',
    clientID: EXAMPLE_CLIENT_ID,
    clientSecret: EXAMPLE_CLIENT_SECRET,
    callbackURL: "http://localhost:3000/auth/example/callback"
  },
  function(accessToken, refreshToken, profile, cb) {
    User.findOrCreate({ exampleId: profile.id }, function (err, user) {
      return cb(err, user);
    });
  }
));

Authenticate Requests

Use passport.authenticate(), specifying the 'oauth2' strategy, to authenticate requests.

For example, as route middleware in an Express application:

app.get('/auth/example',
  passport.authenticate('oauth2'));

app.get('/auth/example/callback',
  passport.authenticate('oauth2', { failureRedirect: '/login' }),
  function(req, res) {
    // Successful authentication, redirect home.
    res.redirect('/');
  });

Strategy Options

authorizationURL

REQUIRED { authorizationURL: string } URL used to obtain an authorization grant

tokenURL

REQUIRED { tokenURL: string } URL used to obtain an access token

clientID

REQUIRED { clientID: string } The client identifier issued to the client by the OAuth 2.0 service.

clientSecret

REQUIRED { clientSecret: string } The client secret issued to the client by the OAuth 2.0 service.

callbackURL

OPTIONAL { callbackURL: string } URL to which the service provider will redirect the user after obtaining authorization. The URL can be relative or fully qualified; when relative, the original URL of the authorization request will be prepended to the relative URL.

customHeaders

OPTIONAL { customHeaders: Object } Custom headers you can pass along with the authorization request.

parseIdToken

OPTIONAL { parseIdToken: boolean } When set to true, the id token is used to construct the user profile instead of the access token (if the authentication response also includes an id token).

passReqToCallback

OPTIONAL { passReqToCallback: boolean } When set to true, the first argument sent to the verify callback is the request, http.IncomingMessage, (default: false)

proxy

OPTIONAL { proxy: boolean } Used when resolving a relative callbackURL. When set to true, req.headers['x-forwarded-proto'] and req.headers['x-forwarded-host'] will be used otherwise req.connection.encrypted and req.headers.host will be used.

Note: if your webserver, e.g. Express, provides req.app.get and the value req.app.get('trust proxy') is set, proxy option will automatically be set to true.

scope

OPTIONAL { scope: Array|string } The scope of the access request made by the client of the OAuth 2.0 service. The scope is a list one or more strings, which are defined by the OAuth 2.0 service.

When the scope is provided as a list of strings, each string should be separated by a single space, as per the OAuth 2.0 spec. When the scope is provided as an Array of strings, each array element will be joined by the scopeSeparator.

scopeSeparator

OPTIONAL { scopeSeparator: string } The separator used to join the scope strings when the scope is provided as an Array (default: single space).

sessionKey

OPTIONAL { sessionKey: string } The key to use to store the state string when the state option is set to true. (default: 'oauth2:' + url.parse(options.authorizationURL).hostname)

skipUserProfile

OPTIONAL { skipUserProfile: boolean } Whether or not to return the user profile information of the user granting authorization to their account information.

state

OPTIONAL { state: boolean } When set to true, a state string with be created, stored, sent along with the authentication request and verified when the response from the OAuth 2.0 service is received.

store

OPTIONAL { store: Function } The store to use when storing the state string (default: SessionStore, req.session[sessionKey], requires session middleware such as express-session). See the NullStore for an example of a store function.

Contributing

Tests

The test suite is located in the test/ directory. All new features are expected to have corresponding test cases. Ensure that the complete test suite passes by executing:

$ make test

Coverage

All new feature development is expected to have test coverage. Patches that increse test coverage are happily accepted. Coverage reports can be viewed by executing:

$ make test-cov
$ make view-cov