Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/toilal/auth-toolbox
The developer toolbox for HTTP Client Authentication.
https://github.com/toilal/auth-toolbox
adapters authentication axios client http interceptors jwt oauth2 openid
Last synced: about 5 hours ago
JSON representation
The developer toolbox for HTTP Client Authentication.
- Host: GitHub
- URL: https://github.com/toilal/auth-toolbox
- Owner: Toilal
- License: mit
- Created: 2018-10-04T21:26:38.000Z (about 6 years ago)
- Default Branch: develop
- Last Pushed: 2023-02-04T21:07:41.000Z (almost 2 years ago)
- Last Synced: 2024-10-28T15:53:21.685Z (23 days ago)
- Topics: adapters, authentication, axios, client, http, interceptors, jwt, oauth2, openid
- Language: TypeScript
- Homepage: https://toilal.github.io/auth-toolbox/
- Size: 2.59 MB
- Stars: 4
- Watchers: 3
- Forks: 1
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: code-of-conduct.md
Awesome Lists containing this project
README
# Auth Toolbox
[](https://www.npmjs.com/package/auth-toolbox)
[](https://github.com/Toilal/auth-toolbox/actions?query=workflow%3Aci)
[](https://coveralls.io/github/Toilal/auth-toolbox?branch=master)
[](https://david-dm.org/Toilal/auth-toolbox?type=dev)
[](https://github.com/semantic-release/semantic-release)
[](https://github.com/Toilal/auth-toolbox)
*The developer toolbox for HTTP Client Authentication.*
Auth Toolbox is a set of JavaScript modules that can be used to add HTTP Client Authentication
to your web application.
It's designed to support any HTTP Client, and any Authorization Server supporting OpenID Connect
/ OAuth 2.0 *Resource Owner Password Credentials Grant*. Any custom similar workflows with
username/password credentials authentication providing an Access Token may be supported
(like PHP Symfony's [lexik/LexikJWTAuthenticationBundle](https://github.com/lexik/LexikJWTAuthenticationBundle) +
[gesdinet/jwt-refresh-token-bundle](https://github.com/gesdinet/JWTRefreshTokenBundle)).
### Disclaimer
This kind of authentication method is commonly discouraged for web applications, but it may be
acceptable for simple applications where Authentication Server and Resource Owner is implemented in
the same service, or if the Authentication Server is dedicated to the application.
You should read this [excellent post by Scott Brady](https://www.scottbrady91.com/OAuth/Why-the-Resource-Owner-Password-Credentials-Grant-Type-is-not-Authentication-nor-Suitable-for-Modern-Applications)
about why you should not use Password Grant authentication. As a more secure alternative, you could
use [oidc-client](https://github.com/IdentityModel/oidc-client-js), but if you really need to avoid
any redirect to the Authorization Server, you should stick with Auth Toolbox.
### Install
```
npm install auth-toolbox
```
### Examples
#### OpenID Connect Password Grant / OAuth 2.0 Password Grant
- *Resource Owner Password Credentials Grant (`grant_type=password`)*
- *Client authentication with id/secret (Basic Auth)*
- *OpenID Auto configuration throw OpenID Discovery*
- *Axios adapter*
```typescript
import Auth, { UsernamePasswordCredentials } from 'auth-toolbox/dist/lib/auth-toolbox'
import OpenidConnectAdapter, { openidConnectDiscovery } from 'auth-toolbox/dist/lib/server-adapter/openid-connect-adapter'
import JwtTokenDecoder from 'auth-toolbox/dist/lib/token-decoder/jwt-token-decoder'
import AxiosAdapter from 'auth-toolbox/dist/lib/client-adapter/axios-adapter'
import axios, { AxiosResponse } from 'axios'
// Keycloak is a great opensource Authentication Server
const openIdIssuerUrl = 'https://keycloak.pragmasphere.com/realms/planireza'
const openIdClientId = 'clientId'
const openIdClientSecret = 'ThisIsSecret!'
const client = axios.create()
const axiosAdapter = new AxiosAdapter(
client,
{ auth: { username: openIdClientId, password: openIdClientSecret } }
)
const auth = new Auth(
openidConnectDiscovery(axiosAdapter, openIdIssuerUrl),
new OpenidConnectAdapter(),
axiosAdapter,
{ accessTokenDecoder: new JwtTokenDecoder() }
)
auth.login('myUsername', 'myPassword').then(() => {
// Read the payload from decoded access token
const payload = auth.decodeAccessToken()
console.log(payload) // Decoded user payload
// This resource requires user to be authenticated.
// Axios interceptors have been automatically registered to handle all the authentication stuff.
return client.get('/restricted')
}).then((r: AxiosResponse) => {
// We are in !
console.log(r.data)
})
```
### Docs
[API Documentation is available](https://toilal.github.io/auth-toolbox/)
### Supported HTTP Clients
Auth Toolbox supports the following HTTP Clients:
- axios
- request (Todo)
- JQuery (Todo)
- Angular (Todo)
- XMLHttpRequest (Todo)
Any other client may be implemented.
### Supported HTTP Servers protocols
Auth Toolbox supports the following protocols out of the box:
- OpenID Connect *Resource Owner Password Credentials Grant* (Access Token + Optional Refresh token)
- OpenID Discovery (`.well-known/openid-configuration` endpoint)
Any custom implementation matching more or less *OAuth 2.0 Password Grant* flow may be implemented.
### Credits
- TypeScript library template generated from [alexjoverm/typescript-library-starter](https://github.com/alexjoverm/typescript-library-starter).