OAuth2orize is an authorization server toolkit for Node.js. It provides a suite of middleware that, combined with Passport authentication strategies and application-specific route handlers, can be used to assemble a server that implements the OAuth 2.0 protocol.
$ npm install oauth2orize
OAuth 2.0 defines an authorization framework, allowing an extensible set of authorization grants to be exchanged for access tokens. Implementations are free to choose what grant types to support, by using bundled middleware to support common types or plugins to support extension types.
Create an OAuth Server
createServer() to create a new OAuth 2.0 server. This instance exposes
middleware that will be mounted in routes, as well as configuration options.
var server = oauth2orize;
A client must obtain permission from a user before it is issued an access token. This permission is known as a grant, the most common type of which is an authorization code.
OAuth2orize also bundles support for implicit token grants.
After a client has obtained an authorization grant from the user, that grant can be exchanged for an access token.
OAuth2orize also bundles support for password and client credential grants. Additionally, bundled refresh token support allows expired access tokens to be renewed.
Implement Authorization Endpoint
When a client requests authorization, it will redirect the user to an authorization endpoint. The server must authenticate the user and obtain their permission.
In this example, connect-ensure-login
middleware is being used to make sure a user is authenticated before
authorization proceeds. At that point, the application renders a dialog
asking the user to grant access. The resulting form submission is processed
Based on the grant type requested by the client, the appropriate grant module registered above will be invoked to issue an authorization code.
Obtaining the user's authorization involves multiple request/response pairs. During this time, an OAuth 2.0 transaction will be serialized to the session. Client serialization functions are registered to customize this process, which will typically be as simple as serializing the client ID, and finding the client by ID when deserializing.
Implement Token Endpoint
Once a user has approved access, the authorization grant can be exchanged by the client for an access token.
Passport strategies are used to authenticate the client, in this case using either an HTTP Basic authentication header (as provided by passport-http) or client credentials in the request body (as provided by passport-oauth2-client-password).
Based on the grant type issued to the client, the appropriate exchange module
registered above will be invoked to issue an access token. If an error occurs,
errorHandler middleware will format an error response.
Implement API Endpoints
Once an access token has been issued, a client will use it to make API requests on behalf of the user.
In this example, bearer tokens are issued, which are then authenticated using an HTTP Bearer authentication header (as provided by passport-http-bearer)
This example demonstrates how to implement an OAuth service provider, complete with protected API access.
- oauth2orize-openid — Extensions to support OpenID Connect
- oauth2orize-jwt-bearer — Exchange JWT assertions for access tokens
- passport-http-bearer — Bearer token authentication strategy for APIs
oauth2orize uses the debug module. You can enable debugging messages on the console by doing
export DEBUG=oauth2orize before running your application.
The test suite is located in the
test/ directory. All new features are
expected to have corresponding test cases. Ensure that the complete test suite
passes by executing:
$ make test
All new feature development is expected to have test coverage. Patches that increse test coverage are happily accepted. Coverage reports can be viewed by executing:
$ make test-cov$ make view-cov
This software is provided to you as open source, free of charge. The time and effort to develop and maintain this project is dedicated by @jaredhanson. If you (or your employer) benefit from this project, please consider a financial contribution. Your contribution helps continue the efforts that produce this and other open source software.
Copyright (c) 2012-2017 Jared Hanson <http://jaredhanson.net/>