npmpackage.info

Gathering detailed insights and metrics for express-jwt-permissions

Other packages similar to express-jwt-permissions

express-gateway-plugin-jwt-permissions

1.0.2

A plugin for Express Gateway for JWT permissions

express-jwt-permissions-x

0.2.0

Express middleware for JWT permissions forked from express-jwt-permissions

express-jwt-authorization

1.3.0

Express middleware for handling JWT permissions

minapi

2.5.0

Minimum viable API w/ authentication and permissions, CRUD and resource management

Gathering detailed insights and metrics for express-jwt-permissions

express-jwt-permissions - 1.3.7 | npmpackage.info

express-jwt-permissions

🚦 Express middleware for JWT permissions

1.3.7

522

MIT

JavaScript

2.83 kB

2,875,284 3

Installations

npm install express-jwt-permissions

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

>=0.10

Node Version

12.22.12

NPM Version

6.14.16 Score

93.3

Supply Chain

99.5

Quality

77.8

Maintenance

100

Vulnerability

99.6

License

Pull Requests

Open

5

Total

66

Closed

34

Merged

27

Issues

Open

4

Total

32

Closed

28

Releases

v1.3.7

Updated on Sep 28, 2022

v1.3.6

Updated on Aug 18, 2021

v1.3.5

Updated on Jun 20, 2021

v1.3.4

Updated on May 25, 2021

v1.3.3

Updated on Jan 28, 2020

v1.3.2

Updated on Oct 30, 2019

View All 17 releases

Languages

JavaScript

JavaScript (100%)

Developer

MichielDeMey

Download Statistics

Total Downloads

2,875,284

Last Day

286

Last Week

13,008

Last Month

54,200

Last Year

524,728

GitHub Statistics

MIT License

522 Stars

114 Commits

37 Forks

9 Watchers

7 Branches

11 Contributors

Updated on Mar 08, 2025

Bundle Size

7.26 kB

Minified

2.83 kB

Minified + Gzipped

Bundlephobia

Maintainers

View All 11 Contributors

Package Meta Information

Latest Version

1.3.7

Package Id

express-jwt-permissions@1.3.7

Unpacked Size

19.45 kB

Size

6.06 kB

File Count

NPM Version

6.14.16

Node Version

12.22.12

Total Downloads

Cumulative downloads

Total Downloads

2,875,284

Last Day

27.1%

286

Compared to previous day

Last Week

-2.9%

13,008

Compared to previous week

Last Month

-9.6%

54,200

Compared to previous month

Last Year

47.7%

524,728

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

express-unless lodash.get

Dev Dependencies

@types/express standard tap

Express JWT Permissions

Middleware that checks JWT tokens for permissions, recommended to be used in conjunction with express-jwt.

Install

npm install express-jwt-permissions --save

Usage

This middleware assumes you already have a JWT authentication middleware such as express-jwt.

The middleware will check a decoded JWT token to see if a token has permissions to make a certain request.

Permissions should be described as an array of strings inside the JWT token, or as a space-delimited OAuth 2.0 Access Token Scope string.

1"permissions": [
2  "status",
3  "user:read",
4  "user:write"
5]

1"scope": "status user:read user:write"

If your JWT structure looks different you should map or reduce the results to produce a simple Array or String of permissions.

Using permission Array

To verify a permission for all routes using an array:

1var guard = require('express-jwt-permissions')()
2
3app.use(guard.check('admin'))

If you require different permissions per route, you can set the middleware per route.

1var guard = require('express-jwt-permissions')()
2
3app.get('/status', guard.check('status'), function(req, res) { ... })
4app.get('/user', guard.check(['user:read']), function(req, res) { ... })

Logical combinations of required permissions can be made using nested arrays.

Single string

1// Required: "admin"
2app.use(guard.check(
3  'admin'
4))

Array of strings

1// Required: "read" AND "write"
2app.use(guard.check(
3  ['read', 'write']
4))

Array of arrays of strings

1// Required: "read" OR "write"
2app.use(guard.check([
3  ['read'],
4  ['write']
5]))
6
7// Required: "admin" OR ("read" AND "write")
8app.use(guard.check([
9  ['admin'],
10  ['read', 'write']
11]))

Configuration

To set where the module can find the user property (default req.user) you can set the requestProperty option.

To set where the module can find the permissions property inside the requestProperty object (default permissions), set the permissionsProperty option.

Example:

Consider you've set your permissions as scope on req.identity, your JWT structure looks like:

1"scope": "user:read user:write"

You can pass the configuration into the module:

1var guard = require('express-jwt-permissions')({
2  requestProperty: 'identity',
3  permissionsProperty: 'scope'
4})
5
6app.use(guard.check('user:read'))

Error handling

The default behavior is to throw an error when the token is invalid, so you can add your custom logic to manage unauthorized access as follows:

1app.use(guard.check('admin'))
2
3app.use(function (err, req, res, next) {
4  if (err.code === 'permission_denied') {
5    res.status(403).send('Forbidden');
6  }
7});

Note that your error handling middleware should be defined after the jwt-permissions middleware.

Excluding paths

This library has integration with express-unless to allow excluding paths, please refer to their usage.

1const checkForPermissions = guard
2  .check(['admin'])
3  .unless({ path: '/not-secret' })
4
5app.use(checkForPermissions)

Tests

$ npm install
$ npm test

License

This project is licensed under the MIT license. See the LICENSE file for more info.

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

7

SAST

Determines if the project uses static code analysis.

1

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

3

/10

Last Scanned on 2025-06-30

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More