npmpackage.info

passport-auth0

Auth0 authentication strategy for Passport.js

1.4.4

296

MIT

JavaScript

13,157,225 6.4

Installations

npm install passport-auth0

Score

Supply Chain

97.8

Quality

82.5

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

1

Total

122

Closed

18

Merged

103

Issues

Open

0

Total

73

Closed

73

Releases

v1.4.4

Published on 30 Oct 2023

v1.4.3

Published on 17 Aug 2022

v1.4.2

Published on 19 Jan 2022

v1.4.1

Published on 13 Oct 2021

v1.3.3

Published on 05 Jun 2020

v1.3.2

Published on 03 Feb 2020

View all 11 releases

Developer

auth0

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

Typescript Support

No

Node Version

18.18.2

NPM Version

9.8.1 Statistics

296 Stars

233 Commits

92 Forks

122 Watching

9 Branches

63 Contributors

Updated on 04 Nov 2024

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

13,157,225

Last day

-21.5%

12,006

Compared to previous day

Last week

-8%

73,073

Compared to previous week

Last month

-3.2%

329,010

Compared to previous month

Last year

15%

3,677,668

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

axios passport-oauth passport-oauth2

Dev Dependencies

jws mocha should

Versions

The Auth0 authentication strategy for Passport.js, an authentication middleware for Node.js that can be unobtrusively dropped into any Express-based web application.

:books: Documentation - :rocket: Getting Started - :speech_balloon: Feedback

Documentation

Docs site - explore our docs site and learn more about Auth0.

Getting started

:information_source: Maintenance Advisory: With the release of https://github.com/auth0/express-openid-connect, we will no longer be adding new features to this library, however we will continue to maintain this library and fix issues. You can read more about the release of our new library at https://auth0.com/blog/auth0-s-express-openid-connect-sdk/

Installation

The Auth0 Passport strategy is installed with npm.

npm install passport-auth0

Customization

State parameter

The Auth0 Passport strategy enforces the use of the state parameter in OAuth 2.0 authorization requests and requires session support in Express to be enabled.

If you require the state parameter to be omitted (which is not recommended), you can suppress it when calling the Auth0 Passport strategy constructor:

1const Auth0Strategy = require('passport-auth0');
2const strategy = new Auth0Strategy({
3     // ...
4     state: false
5  },
6  function(accessToken, refreshToken, extraParams, profile, done) {
7    // ...
8  }
9);

Scopes

If you want to change the scope of the ID token provided, add a scope property to the authenticate configuration passed when defining the route. These must be OIDC standard scopes. If you need data outside of the standard scopes, you can add custom claims to the token.

1app.get(
2	'/login',
3	passport.authenticate('auth0', {scope: 'openid email profile'}), 
4	function (req, res) {
5		res.redirect('/');
6	}
7);

Force a Specific IdP

If you want to force a specific identity provider you can use:

1app.get(
2	'/login/google',
3	passport.authenticate('auth0', {connection: 'google-oauth2'}), 
4	function (req, res) {
5		res.redirect('/');
6	}
7);

If you force an identity provider you can also request custom scope from that identity provider:

1app.get(
2	'/login/google', 
3	passport.authenticate('auth0', {
4		connection: 'google-oauth2',
5		connection_scope: 'https://www.googleapis.com/auth/analytics, https://www.googleapis.com/auth/contacts.readonly'
6	}), 
7	function (req, res) {
8		res.redirect('/');
9	}
10);

Getting Access Tokens

If you want to specify an audience for the returned access_token you can:

1app.get(
2	'/login',
3	passport.authenticate('auth0', {audience: 'urn:my-api'}), 
4	function (req, res) {
5	  res.redirect('/');
6	}
7);

Silent Authentication

If you want to check authentication without showing a prompt:

1app.get(
2	'/login',
3	passport.authenticate('auth0', {prompt: 'none'}), 
4	function (req, res) {
5		res.redirect('/');
6	}
7);

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability Reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Auth0 Logo

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.

No vulnerabilities found.

10

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

10

Security-Policy

Determines if the project has published a security policy.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

10

SAST

Determines if the project uses static code analysis.

6

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

4

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 4

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/codeql.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/codeql.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/codeql.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/codeql.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-release.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/npm-release.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/semgrep.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/semgrep.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/snyk.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/snyk.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/auth0/passport-auth0/test.yml/master?enable=pin
Info: 0 out of 12 GitHub-owned GitHubAction dependencies pinned
Info: 2 out of 2 third-party GitHubAction dependencies pinned

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

Score

6.4

/10

Last Scanned on 2024-11-25

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More