npmpackage.info

Gathering detailed insights and metrics for passport-auth0

Other packages similar to passport-auth0

passport-linkedin-oauth2

2.0.0

Passport for LinkedIn OAuth2 API v2

@types/passport-auth0

1.0.9

TypeScript definitions for passport-auth0

passport-wsfed-saml2

4.6.3

SAML2 Protocol and WS-Fed library

passport-auth0-openidconnect

0.2.0

Auth0 platform authentication strategy for Passport.js based on OpenID Connect

Gathering detailed insights and metrics for passport-auth0

passport-auth0 - 1.4.4 | npmpackage.info

passport-auth0

Auth0 authentication strategy for Passport.js

1.4.4

301

MIT

JavaScript

69.47 kB

6.1

Installations

npm install passport-auth0

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Node Version

18.18.2

NPM Version

9.8.1 Pull Requests

Open

1

Total

129

Closed

25

Merged

103

Issues

Open

0

Total

73

Closed

73

Releases

v1.4.4

Updated on Oct 30, 2023

v1.4.3

Updated on Aug 17, 2022

v1.4.2

Updated on Jan 19, 2022

v1.4.1

Updated on Oct 13, 2021

v1.3.3

Updated on Jun 05, 2020

v1.3.2

Updated on Feb 03, 2020

View All 11 releases

Languages

JavaScript

JavaScript (100%)

Developer

auth0

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

MIT License

301 Stars

233 Commits

93 Forks

124 Watchers

10 Branches

78 Contributors

Updated on May 15, 2025

Maintainers

View All 78 Contributors

Package Meta Information

Latest Version

1.4.4

Package Id

passport-auth0@1.4.4

Unpacked Size

69.47 kB

Size

18.62 kB

File Count

NPM Version

9.8.1

Node Version

18.18.2

Published on

Oct 30, 2023

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

axios passport-oauth passport-oauth2

Dev Dependencies

jws mocha should

The Auth0 authentication strategy for Passport.js, an authentication middleware for Node.js that can be unobtrusively dropped into any Express-based web application.

:books: Documentation - :rocket: Getting Started - :speech_balloon: Feedback

Documentation

Docs site - explore our docs site and learn more about Auth0.

Getting started

:information_source: Maintenance Advisory: With the release of https://github.com/auth0/express-openid-connect, we will no longer be adding new features to this library, however we will continue to maintain this library and fix issues. You can read more about the release of our new library at https://auth0.com/blog/auth0-s-express-openid-connect-sdk/

Installation

The Auth0 Passport strategy is installed with npm.

npm install passport-auth0

Customization

State parameter

The Auth0 Passport strategy enforces the use of the state parameter in OAuth 2.0 authorization requests and requires session support in Express to be enabled.

If you require the state parameter to be omitted (which is not recommended), you can suppress it when calling the Auth0 Passport strategy constructor:

1const Auth0Strategy = require('passport-auth0');
2const strategy = new Auth0Strategy({
3     // ...
4     state: false
5  },
6  function(accessToken, refreshToken, extraParams, profile, done) {
7    // ...
8  }
9);

Scopes

If you want to change the scope of the ID token provided, add a scope property to the authenticate configuration passed when defining the route. These must be OIDC standard scopes. If you need data outside of the standard scopes, you can add custom claims to the token.

1app.get(
2	'/login',
3	passport.authenticate('auth0', {scope: 'openid email profile'}), 
4	function (req, res) {
5		res.redirect('/');
6	}
7);

Force a Specific IdP

If you want to force a specific identity provider you can use:

1app.get(
2	'/login/google',
3	passport.authenticate('auth0', {connection: 'google-oauth2'}), 
4	function (req, res) {
5		res.redirect('/');
6	}
7);

If you force an identity provider you can also request custom scope from that identity provider:

1app.get(
2	'/login/google', 
3	passport.authenticate('auth0', {
4		connection: 'google-oauth2',
5		connection_scope: 'https://www.googleapis.com/auth/analytics, https://www.googleapis.com/auth/contacts.readonly'
6	}), 
7	function (req, res) {
8		res.redirect('/');
9	}
10);

Getting Access Tokens

If you want to specify an audience for the returned access_token you can:

1app.get(
2	'/login',
3	passport.authenticate('auth0', {audience: 'urn:my-api'}), 
4	function (req, res) {
5	  res.redirect('/');
6	}
7);

Silent Authentication

If you want to check authentication without showing a prompt:

1app.get(
2	'/login',
3	passport.authenticate('auth0', {prompt: 'none'}), 
4	function (req, res) {
5		res.redirect('/');
6	}
7);

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability Reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Auth0 Logo

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.

No vulnerabilities found.

10

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

10

Security-Policy

Determines if the project has published a security policy.

10

SAST

Determines if the project uses static code analysis.

6

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

6

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

4

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 4

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/codeql.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/codeql.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/codeql.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/codeql.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-release.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/npm-release.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/semgrep.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/semgrep.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/snyk.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/snyk.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Info: 0 out of 12 GitHub-owned GitHubAction dependencies pinned
Info: 2 out of 2 third-party GitHubAction dependencies pinned

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

Score

6.1

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More