{"id":22268073,"url":"https://github.com/curityio/passport-curity","last_synced_at":"2026-01-25T13:31:30.677Z","repository":{"id":52616754,"uuid":"259974079","full_name":"curityio/passport-curity","owner":"curityio","description":"Curity authentication strategy for Passport.js","archived":false,"fork":false,"pushed_at":"2024-06-23T22:12:40.000Z","size":152,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-12-13T05:38:18.334Z","etag":null,"topics":["oauth2","openid-connect","sdk","website"],"latest_commit_sha":null,"homepage":"https://curity.io/resources/learn/oidc-node-express/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/curityio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-04-29T16:04:16.000Z","updated_at":"2023-04-26T11:10:51.000Z","dependencies_parsed_at":"2025-05-23T10:33:36.919Z","dependency_job_id":"8b087ab0-f29b-44fa-85dc-79998ffe46c4","html_url":"https://github.com/curityio/passport-curity","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/curityio/passport-curity","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/curityio%2Fpassport-curity","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/curityio%2Fpassport-curity/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/curityio%2Fpassport-curity/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/curityio%2Fpassport-curity/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/curityio","download_url":"https://codeload.github.com/curityio/passport-curity/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/curityio%2Fpassport-curity/sbom","scorecard":{"id":312888,"data":{"date":"2025-08-11","repo":{"name":"github.com/curityio/passport-curity","commit":"72ef833c9ac603857e320feca7a796596d472cc5"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.3,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Code-Review","score":2,"reason":"Found 2/7 approved changesets -- score normalized to 2","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE.txt:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE.txt:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":5,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'master'","Info: 'force pushes' disabled on branch 'master'","Info: 'branch protection settings apply to administrators' is required to merge on branch 'master'","Warn: 'stale review dismissal' is disabled on branch 'master'","Warn: required approving review count is 1 on branch 'master'","Warn: codeowners review is not required on branch 'master'","Warn: 'last push approval' is disabled on branch 'master'","Warn: no status checks found to merge onto branch 'master'","Info: PRs are required in order to make changes on branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 7 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":5,"reason":"5 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg","Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv","Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j","Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-17T23:30:21.269Z","repository_id":52616754,"created_at":"2025-08-17T23:30:21.269Z","updated_at":"2025-08-17T23:30:21.269Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28753432,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-25T10:25:12.305Z","status":"ssl_error","status_checked_at":"2026-01-25T10:25:11.933Z","response_time":113,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["oauth2","openid-connect","sdk","website"],"created_at":"2024-12-03T11:10:58.673Z","updated_at":"2026-01-25T13:31:30.659Z","avatar_url":"https://github.com/curityio.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# passport-curity\n\n[![Quality](https://img.shields.io/badge/quality-demo-red)](https://curity.io/resources/code-examples/status/)\n[![Availability](https://img.shields.io/badge/availability-source-blue)](https://curity.io/resources/code-examples/status/)\n\npassport-curity is a strategy for the passport library which enables an effortless integration with the Curity Identity\nServer.\n\nIt covers different scenarios of authenticating a user with the Curity Identity Server using the Open ID Connect protocol.\nIf you're looking for an option to secure your endpoints in an Express API app with JWTs have a look at this library:\n[express-oauth-jwt](https://github.com/curityio/express-oauth-jwt).\n\n## Installation\n\nYou can install the strategy with npm.\n\n```bash\nnpm install passport-curity\n```\n\n## Usage\n\nIn order to properly use the strategy you need to provide it with an openid connect client, the parameters that should\nbe used with the authorization request as well as a `verify` callback, which you can use to process the incoming tokens\nand profile information. (See [passport documentation](http://www.passportjs.org/docs/configure/) to read more about the `verify` callback.)\n\n### Configure the client\n\nYou can use a convenience method `discoverAndCreateClient` to quickly setup the oidc client needed by this strategy.\nThe method returns a `Promise`.\n\n```javascript\ndiscoverAndCreateClient({\n    issuerUrl: 'https://example.com',\n    clientID: \"my-client\",\n    clientSecret: \"S3cret!\",\n    redirectUris: [\"http://localhost:3000/callback\"],\n    responseTypes: ['code', 'token']\n}).then((client) =\u003e {\n    // Create strategy, configure and start the Express app.\n});\n```\n\n* `issuerUrl` is the URL to your instance of the Curity Identity Server. This address is used to access the `.well-known`\nendpoints exposed by the Curity Identity Server in order to obtain all the necessary configuration of the different OAuth and\nOpenID Connect endpoints.\n* `clientID`, `clientSecret` and `redirectUris` should be filled with data used by your client registered with the\nCurity Identity Server.\n* `responseTypes` parameters tells the client which authorization flows will be used by the strategy. This parameter is optional and defaults to `[\"code\"]`.\n\nIf you rather have more control on creating the client have a look at the [openid-client documentation](https://github.com/panva/node-openid-client/blob/master/docs/README.md#client) to check the\navailable options.\n\n### The `verify` callback\n\nEach passport strategy accepts a `verify` callback which can be used to properly handle incoming authorization\ncredentials in the Express app. E.g. create a new user account, save tokens to a database, etc. The `verify` callback\nused by the `passport-curity` strategy has the following signature:\n\n```javascript\nfunction(accessToken, refreshToken, profile, callback) {\n    callback(null, profile); // The callback function needs to be called from the verify callback.\n}\n```\n\n* `accessToken` and `refreshToken` are strings containing the respective tokens, or `null` if the given token was not\nreturned by the given flow.\n* `profile` contains a map of all the claims present in the ID token. If the ID token was not returned in the response\nthe strategy can fall back to requesting this data from the userinfo endpoint. See [Customization](#Customization) to\ncheck how this can be enabled.\n\n### Authorization code flow\n\nHere's a minimal example showing passport configured with the Curity strategy using the authorization code flow:\n\n```javascript\nconst express = require('express');\n\nconst app = express();\nconst passport = require('passport');\nconst CurityStrategy = require('passport-curity').Strategy;\nconst discoverAndCreateClient = require('passport-curity').discoverAndCreateClient;\n\nconst expressSession = require('express-session');\n\nconst session = {\n    secret: \"someSecret\",\n    cookie: {},\n    resave: false,\n    saveUninitialized: false\n  };\n\n(async () =\u003e {\n    // Create the oidc client\n    const client = await discoverAndCreateClient({\n        issuerUrl: 'https://example.com',\n        clientID: \"my-client\",\n        clientSecret: \"S3cret!\",\n        redirectUris: [\"http://localhost:3000/callback\"]\n    });\n\n    // Create the Curity Strategy object\n    const strategy = new CurityStrategy({\n        client,\n        params: {\n            scope: \"openid\"\n        }\n    }, function(accessToken, refreshToken, profile, cb) {\n        cb(null, profile);\n    });\n\n    // Initialize the passport middleware\n    passport.use(strategy);\n\n    passport.serializeUser((user, done) =\u003e {\n        done(null, user);\n    });\n\n    passport.deserializeUser((user, done) =\u003e {\n        done(null, user);\n    });\n\n    app.use(expressSession(session));\n\n    app.use(passport.initialize());\n    app.use(passport.session());\n\n    // The /authorize endpoint initializes the authorization process\n    app.get('/authorize', passport.authenticate('curity'));\n\n    // The callback endpoint is where the Curity Identity Server redirects the user back after positive authentication\n    app.get('/callback', passport.authenticate('curity', { failureRedirect: '/failed', failureMessage: true }), function(req, res) {\n        res.redirect('/');\n    });\n\n    // When a user authenticates and authorizes your app you will be able to access their data in the request object.\n    app.get('/', function(req, res) {\n        res.json({ profile: req.user });\n    });\n\n    app.get('/failed', function(req, res) {\n        res.json({ message: \"Auth failed: \" + req.session.messages[0] });\n    });\n\n    app.listen(3000, function() {\n        console.log(\"Server started on port 3000\");\n    });\n})();\n```\n\n### Implicit flow\n\nIn order to use the implicit flow instead of the code flow you need to change a few lines in the example above:\n\n1. Configure the client with appropriate response types:\n\n```javascript\nconst client = await discoverAndCreateClient({\n        issuerUrl: 'https://example.com',\n        clientID: \"my-client\",\n        clientSecret: \"S3cret!\",\n        redirectUris: [\"http://localhost:3000/callback\"],\n        responseTypes: [\"token\"]\n    });\n```\n\n**Note:** If you only need the ID token you can instead use the response type `id_token`.\n\n2. Set the `response_mode` for the strategy to `form_post` so that the tokens are posted back to the callback endpoint,\nnot sent in the fragment part of the url.\n\n```javascript\nconst strategy = new CurityStrategy({\n        client,\n        params: {\n            scope: \"openid\",\n            response_mode: \"form_post\"\n        }\n    }, function(accessToken, refreshToken, profile, cb) {\n        ...\n    });\n```\n\n**Note:** If you configure the client with more response types then you have to add a `response_type` parameter to the\n`params` map.\n\n3. Configure the callback endpoint to accept POST requests and to properly parse the body of the request:\n\n```javascript\nconst bodyParser = require('body-parser');\napp.use(bodyParser.urlencoded({ extended: false }));\n\napp.post('/auth/example/callback', passport.authenticate('curity', { failureRedirect: '/failed', failureMessage: true}), function(req, res) {\n        res.redirect('/');\n    });\n```\n\n#### Obtaining both: ID token and access token\n\nIt's possible to obtain both the ID token and the access token in one request in an implicit flow. To do that just\nprovide both response types together as one value:\n\n```javascript\nconst client = await discoverAndCreateClient({\n        issuerUrl: 'https://example.com',\n        clientID: \"my-client\",\n        clientSecret: \"S3cret!\",\n        redirectUris: [\"http://localhost:3000/callback\"],\n        responseTypes: [\"token id_token\"]\n    });\n```\n\n## Customization\n\n### userinfo fallback\n\nThe user profile data will normally be decoded from the ID token. However, if the ID token is not present in the\nresponse the strategy can fall back to requesting the userinfo endpoint of the Curity Identity Server. By default this option is\ndisabled. If you want to enable it add `fallbackToUserInfoRequest: true` to the strategy options:\n\n```javascript\nconst strategy = new CurityStrategy({\n    client,\n    params: {\n        scope: \"openid\"\n    },\n    fallbackToUserInfoRequest: true\n}, function(accessToken, refreshToken, profile, cb) {\n    ...\n});\n```\n\n### Setting authorization parameters\n\nThe `params` map in the Curity strategy options is a map of the parameters that are sent together with the authorization\nrequest. E.g. you can set the `prompt` parameter to use the feature as described in the OpenID Connect protocol. So if\nyou add to the `params` map `prompt: \"login\"`, then you will always see a login page regardless of the user being logged\nin or not.\n\nAnother popular parameter you can use is the `scope` parameter, where you can provide a string with space-delimited\nscope tokens - the ones that your app need in order to properly access the user's resources. E.g. `scope: \"openid profile email\"`.\n\nBelow is the list of all the parameters that can be set for requests made by this strategy:\n\n* acr_values\n* audience\n* claims.id_token\n* claims.userinfo\n* claims_locales\n* client_id\n* code_challenge_method\n* code_challenge\n* display\n* id_token_hint\n* login_hint\n* max_age\n* nonce\n* prompt\n* redirect_uri\n* registration\n* request_uri\n* request\n* resource\n* response_mode\n* response_type\n* scope\n* ui_locales\n\n### Other customization\n\nThe Curity passport strategy is based on the `openid-client` library written by Filip Skokan. If you need some more\ncustomization and fine-grained tuning you can have a look the [openid-client documentation](https://github.com/panva/node-openid-client/blob/master/docs/README.md).\n\n## Questions and Support\n\nFor questions and support, contact Curity AB:\n\n\u003e Curity AB\n\u003e\n\u003e info@curity.io\n\u003e \n\u003e [https://curity.io](https://curity.io)\n\nCopyright (C) 2020 Curity AB.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcurityio%2Fpassport-curity","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcurityio%2Fpassport-curity","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcurityio%2Fpassport-curity/lists"}