auth0/express-jwt
Express Jwt
express-jwt este un middleware pentru aplicațiile Express care validează JSON Web Tokens pentru a securiza rutele și a autentifica cererile. Funcționează ca un gardian de securitate care verifică semnăturile token-urilor și datele de expirare înainte de a permite accesul la endpoint-urile backend.
Proiectul oferă un extractor de credențiale pentru cereri pentru a prelua token-uri din headere, cookie-uri sau parametri de query. Suportă preluarea dinamică a cheilor pentru a obține secretele necesare sau cheile publice la runtime, pe baza atributelor cererii sau a headerelor token-ului.
Middleware-ul gestionează validarea JSON Web Token, inclusiv gestionarea expirării token-ului și capacitatea de a verifica identificatorii token-ului față de listele de revocare pentru a invalida token-urile valide din punct de vedere criptografic. De asemenea, mapează atributele payload-ului decodat din token-urile validate direct pe obiectul cererii.
Features
- JWT Authentications - Provides middleware for Express applications to authenticate requests using signed JSON Web Tokens.
- Request Token Validators - Validates token signatures and expiration on every request to secure API endpoints.
- JWT Route Guards - Acts as a route guard that verifies token signatures and expiration before allowing access to backend endpoints.
- JSON Web Token Validators - Provides a robust mechanism to validate the authenticity of JWTs and extract user attributes.
- Token Signature Verification - Implements cryptographic signature verification to ensure the authenticity of JSON Web Tokens.
- Token Validation Middleware - Implements an Express middleware specifically for validating the authenticity and validity of JWTs.
- Request Interception Middleware - Functions as middleware that intercepts incoming HTTP requests to perform security validation before hitting application logic.
- Custom Extractors - Provides a customizable mechanism to extract authentication tokens from headers, cookies, or query parameters.
- Request Credential Extractors - Includes a utility to retrieve authentication tokens from various request sources for validation.
- Claim Mapping - Maps decoded JWT payload attributes directly to the request object for downstream use in the application.
- Key Resolution - Dynamically resolves the correct public key from a set based on token headers at runtime.
- Public Key Retrieval - Fetches the public keys necessary to verify digital signatures at runtime based on token headers.
- Dynamic Key Retrieval - Retrieves the required verification keys at runtime based on request attributes or token headers.
- Token Revocation - Supports checking token identifiers against revocation lists to invalidate cryptographically valid tokens.
- Authentication Token Extraction - Allows the retrieval of authentication tokens from non-standard request sources using custom logic.
- Expiring Tokens - Handles token expiration by allowing specific logic or custom error responses when a token has expired.
