{"id":13528004,"url":"https://github.com/jaredhanson/oauthorize","last_synced_at":"2025-05-13T01:45:24.233Z","repository":{"id":3678948,"uuid":"4748641","full_name":"jaredhanson/oauthorize","owner":"jaredhanson","description":"OAuth service provider toolkit for Node.js.","archived":false,"fork":false,"pushed_at":"2016-03-15T01:20:56.000Z","size":66,"stargazers_count":201,"open_issues_count":2,"forks_count":35,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-05-13T01:45:18.553Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jaredhanson.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2012-06-22T07:30:33.000Z","updated_at":"2025-01-24T00:51:00.000Z","dependencies_parsed_at":"2022-09-06T19:41:13.608Z","dependency_job_id":null,"html_url":"https://github.com/jaredhanson/oauthorize","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jaredhanson%2Foauthorize","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jaredhanson%2Foauthorize/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jaredhanson%2Foauthorize/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jaredhanson%2Foauthorize/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jaredhanson","download_url":"https://codeload.github.com/jaredhanson/oauthorize/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253856613,"owners_count":21974575,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T06:02:09.815Z","updated_at":"2025-05-13T01:45:24.214Z","avatar_url":"https://github.com/jaredhanson.png","language":"JavaScript","funding_links":[],"categories":["JavaScript"],"sub_categories":[],"readme":"# OAuthorize\n\nOAuthorize is a service provider toolkit for Node.js.  It provides a suite of\nmiddleware that, combined with application-specific route handlers, can be used\nto assemble a server that implements the [OAuth](http://tools.ietf.org/html/rfc5849)\n1.0 protocol.\n\n## Installation\n\n    $ npm install oauthorize\n\n## Usage\n\nWhile OAuth is a rather intricate protocol, at a high level there are three\nclasses of endpoints from an implementation perspective, based on how those\nendpoints are authenticated.  OAuthorize middleware, protected by [Passport](http://passportjs.org/)\nauthentication strategies including [passport-http-oauth](https://github.com/jaredhanson/passport-http-oauth),\nis used to authenticate clients, obtain authorization from users, and issue access tokens.\n\n#### Create an OAuth Server\n\nCall `createServer()` to create a new OAuth server.  This instance exposes\nmiddleware that will be mounted in routes, as well as configuration options.\n\n    var server = oauthorize.createServer();\n\n#### Implement Token Endpoints\n\nClients (aka consumers) interact with token endpoints directly in order to\nobtain tokens.  First, a client retrieves an unauthorized request token.\n\n    app.post('/request_token',\n      passport.authenticate('consumer', { session: false }),\n      server.requestToken(function(client, callbackURL, done) {\n        var token = utils.uid(8)\n          , secret = utils.uid(32)\n\n        var t = new RequestToken(token, secret, client.id, callbackURL);\n        t.save(function(err) {\n          if (err) { return done(err); }\n          return done(null, token, secret);\n        });\n      }));\n\nAfter a user has authorized this token, it can be exchanged for an access token.\n\n    app.post('/access_token',\n      passport.authenticate('consumer', { session: false }),\n      server.accessToken(\n        function(requestToken, verifier, info, done) {\n          if (verifier != info.verifier) { return done(null, false); }\n          return done(null, true);\n        },\n        function(client, requestToken, info, done) {\n          if (!info.authorized) { return done(null, false); }\n          if (client.id !== info.clientId) { return done(null, false); }\n\n          var token = utils.uid(32)\n            , secret = utils.uid(128)\n          var t = new AccessToken(token, secret, info.userId, info.clientId);\n          t.save(function(err) {\n            if (err) { return done(err); }\n            return done(null, token, secret);\n          });\n        }\n      ));\n\n#### Implement User Authorization Endpoints\n\nIn order to authorize the request token, the client will redirect the user to\nthe user authorization endpoint.\n\n    app.get('/dialog/authorize',\n      login.ensureLoggedIn(),\n      server.userAuthorization(function(requestToken, done) {\n        RequestToken.findOne(requestToken, function(err, token) {\n          if (err) { return done(err); }\n          Clients.findOne(token.clientId, function(err, client) {\n            if (err) { return done(err); }\n            return done(null, client, token.callbackUrl);\n          });\n        });\n      }),\n      function(req, res){\n        res.render('dialog', { transactionID: req.oauth.transactionID,\n                               client: req.oauth.client, user: req.user });\n      });\n\nThe application is responsible for authenticating the user (in this case, using\n[connect-ensure-login](https://github.com/jaredhanson/connect-ensure-login) middleware)\nand obtaining their consent by rendering a form.\n\nThe user must choose to allow access, optionally limited to a narrower scope or\nduration of access.  The form submission can be processed by user decision\nmiddleware.\n\n    app.post('/dialog/authorize/decision',\n      login.ensureLoggedIn(),\n      server.userDecision(function(requestToken, user, done) {\n        RequestToken.findOne(requestToken, function(err, token) {\n          if (err) { return done(err); }\n          var verifier = utils.uid(8);\n          token.authorized = true;\n          token.userId = user.id;\n          token.verifier = verifier;\n          token.save(function(err) {\n            if (err) { return done(err); }\n            return done(null, verifier);\n          });\n        });\n      }));\n\nOnce authorized, the client can exchange the request token for an access token\nthe token endpoint described above.\n\n#### Implement API Endpoints\n\nOnce an access token has been issued, a client will use it to make API requests\non behalf of the user.\n\n    app.get('/api/userinfo', \n      passport.authenticate('token', { session: false }),\n      function(req, res) {\n        res.json(req.user);\n      });\n\n#### Session Serialization\n\nObtaining the user's authorization involves multiple request/response pairs.\nDuring this time, an OAuth transaction will be serialized to the session.\nClient serialization functions are registered to customize this process, which\nwill typically be as simple as serializing the client ID, and finding the client\nby ID when deserializing.\n\n    server.serializeClient(function(client, done) {\n      return done(null, client.id);\n    });\n\n    server.deserializeClient(function(id, done) {\n      Clients.findOne(id, function(err, client) {\n        if (err) { return done(err); }\n        return done(null, client);\n      });\n    });\n\n## Examples\n\nThis [example](https://github.com/jaredhanson/oauthorize/tree/master/examples/express2) demonstrates\nhow to implement an OAuth service provider, complete with protected API access.\n\n## Tests\n\n    $ npm install --dev\n    $ make test\n\n[![Build Status](https://secure.travis-ci.org/jaredhanson/oauthorize.png)](http://travis-ci.org/jaredhanson/oauthorize)\n\n## Credits\n\n  - [Jared Hanson](http://github.com/jaredhanson)\n\n## License\n\n(The MIT License)\n\nCopyright (c) 2012 Jared Hanson\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjaredhanson%2Foauthorize","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjaredhanson%2Foauthorize","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjaredhanson%2Foauthorize/lists"}