azure-ad-jwt-lite
v1.2.1
Published
Lightweight (<320kb unzipped) library to validate Microsoft AzureAD. Written in typescript fully-tested with 100% code coverage.
Downloads
2,672
Maintainers
Readme
azure-ad-jwt-lite
Lightweight library to verify AzureAD JSON Web Tokens.
It weights around 12KB alone and less than 320KB with its only one dependeny: jsonwebtoken
Other libraries generally includes request
and are bloated. I decided to write this lib because the previous helper I used weighted more than 4MB with all its dependencies!
Futhermore, it is written in typescript and provide its own type definitions.
Last but not least, it is unit tested with one-hundred percent test coverage.
Getting started
Install the package using yarn or NPM: npm i azure-ad-jwt-lite
Do not forget to install jsonwebtoken
types definitions as dev dependency if you are using Typescript: npm i -D @types/jsonwebtoken
.
In your authentication middleware decode and verify the token using:
import { verifyAzureToken } from 'azure-ad-jwt-lite';
const decoded = await verifyAzureToken(token);
You can add any option supported by jsonwebtoken:
import { verifyAzureToken } from 'azure-ad-jwt-lite';
const decoded = await verifyAzureToken(token, {
audience: process.env.JWT_AUD,
issuer: process.env.JWT_ISS,
});
Additional options
Discovery URL: The URL to fetch Microsoft public keys (defaults to https://login.microsoftonline.com/common/discovery/keys)
Retries on 5xx: set the number of retries when request to fetch keys returns a 5xx response (defaults to 2)
import { verifyAzureToken } from 'azure-ad-jwt-lite';
const decoded = await verifyAzureToken(token, {
discoveryUrl: `https://login.microsoftonline.com/${process.env.TENANT}/discovery/keys?appid=${process.env.APP_ID}`,
maxRetries: 5,
audience: process.env.JWT_AUD,
issuer: process.env.JWT_ISS,
});
Caching keys
Public keys from discovery endpoint calls are cached for a default TTL of 5 minutes.
You can disable caching using useCache: false
in options, or modify TTL using cacheTtl
option.
Error reference
The lib will throw the following errors if something wrong happends during decoding token:
InvalidToken
: the token provided is not a non-empty string.TokenNotDecoded
: the token cannot be decoded. This usually means the token is ill-formed.MissingKeyID
: nokid
(Microsoft Key ID) field is present in JWT header.ErrorFetchingKeys
: API call to fetch Microsoft public keys failed.NotMatchingKey
: no matching key is found in Microsoft response.JsonWebTokenError
: token cannot be verified, the human-readable reason is provided (expired, audience mismatch etc...)