README
@articulate/authentic
Proper validation of JWT's against JWK's.
Motivation
The process of validating JWT's against JWK's is quite involved, but at the end of the day, you probably have an auth server with a /.well-known/openid-configuration
endpoint, and you just want to know if an incoming JWT is valid. End of story. You don't want to fumble with parsing the JWT, matching kid
values, converting certs, or caching JWK's.
Now you don't need to. Initialize authentic
with an issWhitelist
, and you'll receive a function that accepts a JWT and validates it. The rest is handled for you.
Usage
authentic :: { k: v } -> String -> Promise Boom { k: v }
Initialize authentic
with an options object containing an issWhitelist
array listing the token.payload.iss
values you will accept. For example:
Provider | Sample issWhitelist |
---|---|
Auth0 | [ 'https://${tenant}.auth0.com/' ] |
Okta | [ 'https://${tenant}.oktapreview.com/oauth2/${appName}' ] |
Note: The urls in the list need to be exact matches of the payload.iss
values in your JWT's.
You'll receive a unary function which takes a JWT and returns a Promise
that resolves with the parsed JWT payload if it is valid, or rejects with a 401
Boom error if it is invalid.
const authentic = require('@articulate/authentic')({
issWhitelist: JSON.parse(process.env.ISS_WHITELIST)
})
const handler = req =>
authentic(req.cookies.token)
.then(/* the JWT has been validated */)
Options
authentic
accepts a JSON object with the following options:
jwks
Object: options to forward tonode-jwks-rsa
with the following defaults:
option | default |
---|---|
cache |
true |
rateLimit |
true |
verify
Object: options to forward tojwt.verify
fromjsonwebtoken
issWhitelist
Array: list of trusted OIDC issuersclaimsInError
Array: list of jwt payload claims to receive as thedata
propery of the error when verification fails. When a list is not provided adata
property will not be added to the error.