Auth0 headless browser sdk
Auth0 is an authentication broker that supports social identity providers as well as enterprise identity providers such as Active Directory, LDAP, Office365, Google Apps, Salesforce.
Auth0.js is a client-side library for Auth0. It allows you to trigger the authentication process and parse the JWT (JSON web token) with just the Auth0
clientID. Once you have the JWT you can use it to authenticate requests to your http API and validate the JWT in your server-side logic with the
The example directory has a ready-to-go app. In order to run it you need node installed, download dependencies with
npm install, then execute
npm run example from the root of this project.
auth0.min.js from the
/build directory and import it to your page.
If you are using browserify install with
npm i auth0-js --production --save.
Note: The following examples use jQuery, but auth0.js is not tied to jQuery and any library can be used with it.
Construct a new instance of the Auth0 client as follows:
Trigger the login on any of your active identity provider as follows:
//trigger login with google$'.login-google'clickauth0loginconnection: 'google-oauth2';;//trigger login with github$'.login-github'clickauth0loginconnection: 'github';;//trigger login with an enterprise connection$'.login-github'clickauth0loginconnection: 'contoso.com';;//trigger login with a db connection$'.login-dbconn'clickauth0loginconnection: 'db-conn'username: $'.username'valpassword: $'.password'val;;//trigger login with a db connection and avoid the redirect (best experience for SPA)$'.login-dbconn'clickauth0loginconnection: 'db-conn'username: $'.username'valpassword: $'.password'val// store in cookies;;//trigger login popup with google$'.login-google-popup'clickepreventDefault;auth0loginconnection: 'google-oauth2'popup: truepopupOptions:width: 450height: 800if erralert"something went wrong: " + errmessage;return;alert'hello ' + profilename;;;
You can also request scopes that are not were not configured for the connection.
//trigger login requesting additional scopes with google$'.login-google'clickauth0loginconnection: 'google-oauth2'connection_scope: '' '';;// alternatively a comma separated list also works$'.login-google'clickauth0loginconnection: 'google-oauth2'connection_scope: '';;
Trigger the login with offline mode support to get the
$'.login-dbconn'clickauth0loginconnection: 'db-conn'username: $'.username'valpassword: $'.password'valscope: 'openid offline_access'// store in cookies// refresh_token is sent because offline_access is set as a scope;;
Once you have succesfully authenticated, Auth0 will redirect to your
callbackURL with a hash containing an
access_token and the jwt (
id_token). You can parse the hash and retrieve the full user profile as follows:
$var result = auth0parseHashwindowlocationhash;//use result.id_token to call your rest apiif result && resultid_tokenauth0getProfileresultid_tokenalert'hello ' + profilename;;// If offline_access was a requested scope// You can grab the result.refresh_token hereelse if result && result.erroralert'error: ' + result.error;;
Or just parse the hash (if loginOption.scope is not
openid profile, then the profile will only contains the
$var result = auth0parseHashwindowlocationhash;if result && resultprofilealert'your user_id is: ' + resultprofilesub;//use result.id_token to call your rest api;;
If there is no hash,
result will be null. It the hash contains the jwt, the profile field will be populated.
While using this mode, the result will be passed as the
login method callback.
auth0login popup: trueif err// Handle the error!return;//use id_token to call your rest apialert'hello ' + profilename;// refresh_token is sent only if offline_access is set as a scope;;
When using database connection there are two possible modes:
Resource Owner endpoint (
/ro)enabled by passing sso: false (default): Performs a CORS POST request against the former endpoint (or in IE8 or 9 perform a JSONP request). This endpoint allows users to authenticate by sending their username and password and returning a JWT. This does not set any cookie and no popup is opened (even with
SSO mode enabled by passing
sso: true: In this case, a popup is created in which the authentication takes place. Sets the SSO cookie and prompts for a multifactor authentication code, if enabled.
If you use Database Connections you can signup as follows:
$'.signup'clickauth0signupconnection: 'db-conn'username: 'firstname.lastname@example.org'password: 'blabla'console.logerrmessage;;;
After a succesful login it will auto login the user. If you do not want to automatically login the user you have to pass the option
$'.change_password'clickauth0changePasswordconnection: 'db-conn'username: 'email@example.com'password: 'blabla' // new passwordconsole.logerrmessage;;;
A delegation token is a new token for a different service or app/API.
If you just want to get a new token for an addon that you've activated, you can do the following:
var options =id_token: "your id token" // The id_token you have nowapi: 'firebase' // This defaults to the first active addon if any or you can specify this"scope": "openid profile" // default: openid;auth0getDelegationTokenoptions// Call your API using delegationResult.id_token;
If you want to get the token for another API or App:
var options =id_token: "your id token" // The id_token you have nowapi: 'auth0' // This is default when calling another app that doesn't have an addontargetClientId: 'The other client id';auth0getDelegationTokenoptions// Call your API using delegationResult.id_token;
If you want to refresh your existing (not expired) token, you can just do the following:
auth0renewIdTokencurrent_id_token// Get here the new delegationResult.id_token;
If you want to refresh your existing (expired) token, if you have the refresh_token, you can call the following:
auth0refreshTokenrefresh_token// Get here the new delegationResult.id_token;
You can validate a user of a specific connection with his username and password:
auth0validateUserconnection: 'db-conn'username: 'firstname.lastname@example.org'password: 'blabla';
getSSOData fetches Single Sign-On information:
auth0getSSODataif err return console.logerrmessage;expectssoDatassotoexist;;
Load Active Directory data if available (Kerberos):
When Kerberos is available you can automatically trigger Windows Authentication. As a result the user will immediately be authenticated without taking any action.
auth0getSSODatatrueif !err && ssoData && ssoDataconnectionauth0login connection: ssoDataconnection ;;
grunt dev and point your browser to
http://localhost:9999/test_harness.html to run the test suite.
grunt phantom if you have PhantomJS installed.
grunt integration (or
npm test) if you have SauceLabs account. You will need a
SAUCE_USERNAME env variables.
$ ./bin/version patch$ git push origin master
If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
This project is licensed under the MIT license. See the LICENSE file for more info.