npmpackage.info

Gathering detailed insights and metrics for @luigi-project/plugin-auth-oidc-pkce

@luigi-project/plugin-auth-oidc-pkce - 0.42.0 | npmpackage.info

@luigi-project/plugin-auth-oidc-pkce

Micro frontend framework

0.42.0

872

Apache-2.0

JavaScript

79.39 kB

5.7

Installations

npm install @luigi-project/plugin-auth-oidc-pkce

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Node Version

20.14.0

NPM Version

10.7.0 Score

49.2

Supply Chain

89.4

Quality

78.1

Maintenance

100

Vulnerability

99.6

License

Pull Requests

Open

12

Total

2,679

Closed

373

Merged

2,294

Issues

Open

20

Total

1,645

Closed

1,625

Releases

143

v2.22.1

Updated on May 23, 2025

v2.22.0

Updated on May 20, 2025

container/v1.7.0

Updated on Apr 23, 2025

v2.21.3

Updated on Apr 23, 2025

v2.21.2

Updated on Mar 21, 2025

v2.21.1

Updated on Mar 04, 2025

View All 143 releases

Languages

JavaScript

Svelte

HTML

TypeScript

SCSS

Shell

CSS

Vue

JavaScript (62.34%)

Svelte (14.38%)

HTML (10.02%)

TypeScript (8.74%)

SCSS (2.49%)

Shell (1.65%)

CSS (0.35%)

Vue (0.05%)

Developer

SAP

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

Apache-2.0 License

872 Stars

2,450 Commits

178 Forks

18 Watchers

26 Branches

63 Contributors

Updated on Jul 11, 2025

Maintainers

View All 63 Contributors

Package Meta Information

Latest Version

0.42.0

Package Id

@luigi-project/plugin-auth-oidc-pkce@0.42.0

Unpacked Size

79.39 kB

Size

21.59 kB

File Count

NPM Version

10.7.0

Node Version

20.14.0

Published on

Sep 25, 2024

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

No dependencies detected.

OpenID Connect with PKCE - Authorization Plugin for Luigi Core

Overview

This authorization plugin contains a library that allows your application to extend the Luigi framework with an OpenID Connect authorization provider. Further configuration details can be found in the main documentation. The plugin supports only Authorization Code flow with PKCE - for Implict flow please check older OIDC plugin.

Installation

Install the plugin in your project using npm:

1npm install @luigi-project/plugin-auth-oidc-pkce

Import the plugin in places where you want to use it, depending on the environment of your choice:

1var OpenIdConnect = require('@luigi-project/plugin-auth-oidc-pkce');

1import OpenIdConnect from '@luigi-project/plugin-auth-oidc-pkce';

Then, integrate it as an authorization provider in your Luigi configuration file:

1Luigi.setConfig({
2  auth: {
3    use: 'myProviderConfig',
4    myProviderConfig: {
5      idpProvider: OpenIdConnect,
6      authority: 'http://authority.server',
7      post_logout_redirect_uri: 'http://authority.server/connect/endsession',
8      scope: 'openid profile email',
9
10      // for PKCE flow
11      client_id: 'authorisation-code-pkce-mock-client', // example oidc-mockserver client id
12      response_type: "code", // for PKCE
13      response_mode: "fragment", // change between `query` and `fragment`
14
15      // ... further configuration data comes here
16    }
17  }
18})

If you want to use the silent token renewal feature, the silent-callback.html needs to be copied to a folder in your Luigi Core installation, which is the return path for the IdP provider, configured through the silent_redirect_uri setting. The default location of silent_redirect_uri is /assets/auth-oidc-pkce/silent-callback.html.

Next, you must install oidc-client-ts in your project as a dev dependency:

1npm i -save-dev oidc-client-ts

Then, you need to copy certain auxiliary plugin files and the callback file, as they are needed for the initial setup.

Respectively from oidc-client-ts library you need:

oidc-client-ts.min.js which normally resides in node_modules/oidc-client-ts/dist/browser

and from our library @luigi-project/plugin-auth-oidc-pkce you need:

plugin.js
silent-callback.html which all reside under node_modules/@luigi-project/plugin-auth-oidc-pkce/plugin.js.

The above mentioned files should be copied to assets/auth-oidc-pkce as the default location.

Below we give some alternatives on how to easily copy these files in your project. However, you may choose your own way of copying these files depending on your environment.

For applications involving a webpack configuration, one way to copy files is using packages such as copy-webpack-plugin and then including the following in your webpack configuration file:

1const CopyWebpackPlugin = require('copy-webpack-plugin');
2
3{
4  plugins: [
5    new CopyWebpackPlugin([
6     {
7         from: 'node_modules/@luigi-project/plugin-auth-oidc-pkce/plugin.js',
8         to: 'assets/auth-oidc-pkce'
9     },
10     {
11         from: 'node_modules/@luigi-project/plugin-auth-oidc-pkce/silent-callback.html',
12         to: 'assets/auth-oidc-pkce'
13     },
14     {
15         from: 'node_modules/oidc-client-ts/dist/browser/oidc-client-ts.min.js',
16         to: 'assets/auth-oidc-pkce'
17     }
18    ])
19  ]
20}

If your application does not use webpack or you installed Luigi without a framework, you can use an alternative way of copying the silent-callback.html file. You can use any copy plugin to copy the file and then modify the package.json script to copy the file when building. One package that could be helpful is copyfiles. Below is an example:

1"buildConfig": "webpack --entry ./src/luigi-config/luigi-config.es6.js --output-path ./public/assets --output-filename luigi-config.js --mode production",
2"build": "npm run buildConfig && npm run copyCallbackOIdc",
3"copyCallbackOidc": "copyfiles -f node_modules/@luigi-project/plugin-auth-oidc-pkce/silent-callback.html node_modules/@luigi-project/plugin-auth-oidc-pkce/plugin.js node_modules/oidc-client-ts/dist/browser/oidc-client-ts.min.js public/assets/auth-oidc-pkce"

Running npm run build should then suffice to bundle the config and also copy the callback file.

No vulnerabilities found.

10

Maintained

Determines if the project is "actively maintained".

10

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

10

Security-Policy

Determines if the project has published a security policy.

2

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 2

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/auth-oidc-pkce-plugin-release.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/auth-oidc-pkce-plugin-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/auth-oidc-pkce-plugin-release.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/auth-oidc-pkce-plugin-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/auth-oidc-pkce-plugin-release.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/auth-oidc-pkce-plugin-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/checkmarx.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/checkmarx.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/code_checks.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/code_checks.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/code_checks.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/code_checks.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/compatibility.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/compatibility.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/compatibility.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/compatibility.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/compatibility.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/compatibility.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/container-coverage.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/container-coverage.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/container-coverage.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/container-coverage.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/container-coverage.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/container-coverage.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/container-release.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/container-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/container-release.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/container-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/container-release.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/container-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/luigi-client-support-angular-release.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/luigi-client-support-angular-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/luigi-client-support-angular-release.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/luigi-client-support-angular-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/luigi-client-support-angular-release.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/luigi-client-support-angular-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/luigi-client-support-ui5-release.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/luigi-client-support-ui5-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/luigi-client-support-ui5-release.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/luigi-client-support-ui5-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/luigi-client-support-ui5-release.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/luigi-client-support-ui5-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/mend.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/mend.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/mend.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/mend.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/mend.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/mend.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly-release.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/nightly-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly-release.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/nightly-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly-release.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/nightly-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/prepare.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/prepare.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/prepare.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/prepare.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/prepare.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/prepare.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_cra.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/publish_cra.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_cra.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/publish_cra.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rc-release.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/rc-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rc-release.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/rc-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rc-release.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/rc-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/setupScripts.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/setupScripts.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:127: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:107: update your workflow using https://app.stepsecurity.io/secureworkflow/luigi-project/luigi/test.yml/main?enable=pin
Warn: npmCommand not pinned by hash: scripts/setup/angular.sh:17
Warn: npmCommand not pinned by hash: scripts/setup/no-framework.sh:20
Warn: npmCommand not pinned by hash: scripts/setup/openui5.sh:46
Warn: npmCommand not pinned by hash: scripts/setup/react.sh:19
Warn: npmCommand not pinned by hash: scripts/setup/react.sh:20
Warn: npmCommand not pinned by hash: scripts/setup/react.sh:71
Warn: npmCommand not pinned by hash: scripts/setup/vue.sh:24
Warn: npmCommand not pinned by hash: scripts/shared/bashHelpers.sh:34
Warn: npmCommand not pinned by hash: scripts/testCompatibility.sh:188
Warn: npmCommand not pinned by hash: test/setuptests.sh:46
Warn: npmCommand not pinned by hash: website/landingpage/build.sh:6
Warn: npmCommand not pinned by hash: .github/workflows/code_checks.yml:24
Warn: npmCommand not pinned by hash: .github/workflows/container-coverage.yml:24
Warn: npmCommand not pinned by hash: .github/workflows/container-coverage.yml:27
Warn: npmCommand not pinned by hash: .github/workflows/mend.yml:29
Warn: npmCommand not pinned by hash: .github/workflows/mend.yml:30
Warn: npmCommand not pinned by hash: .github/workflows/test.yml:55
Warn: npmCommand not pinned by hash: .github/workflows/test.yml:56
Warn: npmCommand not pinned by hash: .github/workflows/test.yml:118
Info: 0 out of 63 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 1 third-party GitHubAction dependencies pinned
Info: 10 out of 29 npmCommand dependencies pinned

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

5.7

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More