express-jwt-validator

Helper for validating oauth2/openid-connect JWT tokens using public keys loaded from identity providers.

Config

| Name | Description | | -------------------------- | --------------------------------------------------------------------------------- | | JWT_ISSUER | JWT Issuer | | JWT_ALGORITHM | Algorithm of the private key that was used to sign the JWT token | | JWT_JWKS_URI | URL to JWKS (json web keys) endpoint | | JWT_JWKS_TIMEOUT | Timeout for http client when fetching JWKS | | JWT_JWKS_CACHE | Enables/disables JWK local cache | | JWT_JWKS_CACHE_MAX_ENTRIES | Max entries to keep in the JWK local cache | | JWT_JWKS_CACHE_MAX_AGE | Max age of items in the local JWK cache | | JWT_JWKS_RATE_LIMIT | Enables/disables JWKS http client rate limiting | | JWT_JWKS_RATE_LIMIT_RPM | Number of allowed JWKS http client calls per minute | | cookieToken | Sets which token to extract from cookie for jwt validation (id, access [default]) |

Usage

// init validator instance (should use 1 instance per app)
import { jwtValidator, Config } from 'express-jwt-validator`';

const config: Config = {
  jwtJwksUri: 'https://testing.well-known.uri/jwks.json',
  jwtJwksTimeout: 1000,

  jwtJwksCache: false,
  jwtJwksCacheMaxEntries: 1,
  jwtJwksCacheMaxAge: 1000,

  jwtJwksRateLimit: false,
  jwtJwksRateLimitRpm: 100,

  jwtIssuer: 'test-issuer',
  jwtAlgorithm: 'RS256',
  cookieToken: 'id'; // optional, default is 'access'
};

const validateJwt = jwtValidator(config);

// register jwt validator in a specific express route
this.router.get('/user-info', validateJwt, authController.userInfo);

// use token information in route handlers
import { AuthorizedRequest } from 'express-jwt-validator';

getResource: RequestHandler = forwardError(async (req: AuthorizedRequest, res: Response): Promise<void> => {
  // access token information under user field
  const userName = req.user.username;
  const scope = req.user.scope;
  const clientId = req.user.client_id;
  const roles = req.user['cognito:groups'];
}

// For this to work you have to include cookieToken config set to 'id'
getResourceIdToken: RequestHandler = forwardError(async (req: IdAuthorizedRequest, res: Response): Promise<void> => {
  // id token information under user field
  const scope = req.user.email;
  const clientId = req.user['custom:workspaceId'];
    const roles = req.user['cognito:groups'];

}