npmpackage.info

verify-apple-id-token

Verify the Apple id token on the server side.

3.1.2

MIT

TypeScript

Installations

npm install verify-apple-id-token

Pull Requests

Open

4

Total

288

Closed

132

Merged

152

Issues

Open

2

Total

12

Closed

10

Releases

v3.1.2

Published on 27 Jan 2024

v3.1.1

Published on 15 Jan 2024

v3.1.0

Published on 21 Nov 2023

v3.0.1

Published on 21 Jan 2023

v3.0.0

Published on 07 Jul 2022

Multiple clientIds release

v2.1.0

Published on 29 Jun 2021

View all 11 releases

Developer

stefan-prokop-cz

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

Typescript Support

Yes

Node Version

18.19.0

NPM Version

10.2.3 Statistics

87 Stars

209 Commits

17 Forks

2 Watching

6 Branches

8 Contributors

Updated on 25 Nov 2024

Languages

TypeScript (91.4%)

JavaScript (8.6%)

Total Downloads

Cumulative downloads

Total Downloads

1,877,786

Last day

8.8%

2,721

Compared to previous day

Last week

1.1%

13,484

Compared to previous week

Last month

9.3%

57,417

Compared to previous month

Last year

-12.6%

689,483

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

jsonwebtoken jwks-rsa

Dev Dependencies

@types/jest @types/jsonwebtoken @typescript-eslint/eslint-plugin @typescript-eslint/parser eslint eslint-config-airbnb-base eslint-config-airbnb-typescript eslint-config-prettier eslint-plugin-import eslint-plugin-prettier jest mock-jwks mockdate nock prettier ts-jest typescript

Versions

Verify Apple idToken

Small utility which verifies the Apple idToken
You can use it on the backend side
Token verification is part of Apple sign-in process
The flow is
- Client app (iOS or Android) will redirect user to the OAuth2 login screen
- User will login
- App will receive the tokens
- App should send the idToken to the backend which will verify it
Verification steps implemented:
- Verify the JWS E256 signature using the server’s public key
- Verify the nonce for the authentication
- Verify that the iss field contains https://appleid.apple.com
- Verify that the aud field is the developer’s client_id
- Verify that the time is earlier than the exp value of the token

Installation

1npm install verify-apple-id-token

Usage

Typescript

1import verifyAppleToken from "verify-apple-id-token";
2
3const jwtClaims = await verifyAppleToken({
4  idToken: "yourIdToken",
5  clientId: "yourAppleClientId", // or ["app1ClientId", "app2ClientId"]
6  nonce: "nonce", // optional
7});
8
9jwtClaims.email; // get email of the user

Javascript

1const verifyAppleToken = require("verify-apple-id-token").default;
2
3const jwtClaims = await verifyAppleToken({
4  idToken: "yourIdToken",
5  clientId: "yourAppleClientId",  // or ["app1ClientId", "app2ClientId"]
6  nonce: "nonce", // optional
7});

Contribution

Thank you for your interest in contributing to verify-apple-id-token! Please see the CONTRIBUTING.md to learn how to do it!

License

MIT

No vulnerabilities found.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

10

License

Determines if the project has defined a license.

10

Packaging

Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.

8

SAST

Determines if the project uses static code analysis.

2

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

Score

4.5

/10

Last Scanned on 2024-11-18

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to verify-apple-id-token

passport-apple-verify-token

1.1.0

Sign In with Apple Token strategy for Passport, let's you validate the user token server side, usefull for mobile app SignIn with Apple authentication for example. The validation is done by using the public AppleID authentication keys.

passport-jwt

4.0.1

Passport authentication strategy using JSON Web Tokens

idtoken-verifier

2.2.4

A lightweight library to decode and verify RS JWT meant for the browser.

aws-jwt-verify

4.0.1

Verify RS256/RS384/RS512 signed JSON Web Tokens (JWT)