Ready to take your JavaScript development to the next level? Meet npm Enterprise - the ultimate in enterprise JavaScript. Learn more »

@articulate/authentic

0.2.0 • Public • Published

@articulate/authentic

@articulate/authentic Build Status Coverage Status

Proper validation of JWT's against JWK's.

Motivation

The process of validating JWT's against JWK's is quite involved, but at the end of the day, you probably have an auth server with a /.well-known/openid-configuration endpoint, and you just want to know if an incoming JWT is valid. End of story. You don't want to fumble with parsing the JWT, matching kid values, converting certs, or caching JWK's.

Now you don't need to. Initialize authentic with an issWhitelist, and you'll receive a function that accepts a JWT and validates it. The rest is handled for you.

Usage

authentic :: { k: v } -> String -> Promise Boom { k: v }

Initialize authentic with an options object containing an issWhitelist array listing the token.payload.iss values you will accept. For example:

Provider Sample issWhitelist
Auth0 [ 'https://${tenant}.auth0.com/' ]
Okta [ 'https://${tenant}.oktapreview.com/oauth2/${appName}' ]

Note: The urls in the list need to be exact matches of the payload.iss values in your JWT's.

Any other options passed to authentic will be forwarded to jwt.verify() for validation and parsing. See the list of available options here.

You'll receive a unary function which takes a JWT and returns a Promise that resolves with the parsed JWT payload if it is valid, or rejects with a 401 Boom error if it is invalid.

const authentic = require('@articulate/authentic')({
  issWhitelist: JSON.parse(process.env.ISS_WHITELIST)
})
 
const handler = req =>
  authentic(req.cookies.token)
    .then(/* the JWT has been validated */)

Keywords

none

install

npm i @articulate/authentic

Downloadsweekly downloads

630

version

0.2.0

license

MIT

homepage

github.com

repository

Gitgithub

last publish

collaborators

  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
  • avatar
Report a vulnerability