You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Middleware that validates JsonWebTokens and sets `req.user`.
6
-
7
-
This module lets you authenticate HTTP requests using JWT tokens in your Node.js
8
-
applications. JWTs are typically used to protect API endpoints, and are
9
-
often issued using OpenID Connect.
5
+
This module provides Express middleware for validating and decoding JWTs ([JSON Web Tokens](https://jwt.io)) through the [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken/) module. The decoded information is provided on the Express request object.
10
6
11
7
## Install
12
8
13
-
$ npm install express-jwt
9
+
```
10
+
$ npm install express-jwt
11
+
```
14
12
15
13
## Usage
16
14
17
-
The JWT authentication middleware authenticates callers using a JWT.
18
-
If the token is valid, `req.user` will be set with the JSON object decoded
19
-
to be used by later middleware for authorization and access control.
20
-
21
-
For example,
15
+
Basic usage using an HS256 secret:
22
16
23
17
```javascript
24
18
var jwt =require('express-jwt');
25
19
26
20
app.get('/protected',
27
-
jwt({secret:'shhhhhhared-secret'}),
21
+
jwt({secret:'shhhhhhared-secret'}),
28
22
function(req, res) {
29
23
if (!req.user.admin) returnres.sendStatus(401);
30
24
res.sendStatus(200);
@@ -34,9 +28,11 @@ app.get('/protected',
34
28
You can specify audience and/or issuer as well:
35
29
36
30
```javascript
37
-
jwt({ secret:'shhhhhhared-secret',
31
+
jwt({
32
+
secret:'shhhhhhared-secret',
38
33
audience:'http://myapi/protected',
39
-
issuer:'http://issuer' })
34
+
issuer:'http://issuer'
35
+
})
40
36
```
41
37
42
38
> If the JWT has an expiration (`exp`), it will be checked.
@@ -100,6 +96,7 @@ app.use(jwt({
100
96
```
101
97
102
98
### Multi-tenancy
99
+
103
100
If you are developing an application in which the secret used to sign tokens is not static, you can provide a callback function as the `secret` parameter. The function has the signature: `function(req, payload, done)`:
104
101
*`req` (`Object`) - The express `request` object.
105
102
*`payload` (`Object`) - An object with the JWT claims.
@@ -108,6 +105,7 @@ If you are developing an application in which the secret used to sign tokens is
108
105
*`secret` (`String`) - The secret to use to verify the JWT.
109
106
110
107
For example, if the secret varies based on the [JWT issuer](http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html#issDef):
108
+
111
109
```javascript
112
110
var jwt =require('express-jwt');
113
111
var data =require('./data');
@@ -126,7 +124,7 @@ var secretCallback = function(req, payload, done){
126
124
};
127
125
128
126
app.get('/protected',
129
-
jwt({secret: secretCallback}),
127
+
jwt({secret: secretCallback}),
130
128
function(req, res) {
131
129
if (!req.user.admin) returnres.sendStatus(401);
132
130
res.sendStatus(200);
@@ -158,19 +156,21 @@ var isRevokedCallback = function(req, payload, done){
158
156
};
159
157
160
158
app.get('/protected',
161
-
jwt({secret:'shhhhhhared-secret',
162
-
isRevoked: isRevokedCallback}),
159
+
jwt({
160
+
secret:'shhhhhhared-secret',
161
+
isRevoked: isRevokedCallback
162
+
}),
163
163
function(req, res) {
164
164
if (!req.user.admin) returnres.sendStatus(401);
165
165
res.sendStatus(200);
166
-
});
166
+
}
167
+
);
167
168
```
168
169
169
170
### Error handling
170
171
171
172
The default behavior is to throw an error when the token is invalid, so you can add your custom logic to manage unauthorized access as follows:
You might want to use this module to identify registered users while still providing access to unregistered users. You
183
-
can do this by using the option _credentialsRequired_:
182
+
You might want to use this module to identify registered users while still providing access to unregistered users. You can do this by using the option `credentialsRequired`:
184
183
185
184
```javascript
186
185
app.use(jwt({
@@ -196,8 +195,10 @@ app.use(jwt({
196
195
197
196
## Tests
198
197
199
-
$ npm install
200
-
$ npm test
198
+
```
199
+
$ npm install
200
+
$ npm test
201
+
```
201
202
202
203
## Contributors
203
204
Check them out [here](https://github.com/auth0/express-jwt/graphs/contributors)
0 commit comments