aaj
azure-ad-jwt-lite
npm i azure-ad-jwt-lite
aaj

azure-ad-jwt-lite

Lightweight (<320kb unzipped) library to validate Microsoft AzureAD. Written in typescript fully-tested with 100% code coverage

by Mario Arnautou

1.2.0 (see all)License:MITTypeScript:Built-In
npm i azure-ad-jwt-lite
Readme

azure-ad-jwt-lite

Build Status codecov Known Vulnerabilities Maintainability

Logo

Lightweight library to verify AzureAD JSON Web Tokens.

It weights around 12KB alone and less than 320KB with its only one dependeny: jsonwebtoken

Other libraries generally includes request and are bloated. I decided to write this lib because the previous helper I used weighted more than 4MB with all its dependencies!

Futhermore, it is written in typescript and provide its own type definitions.

Last but not least, it is unit tested with one-hundred percent test coverage.

Getting started

Install the package using yarn or NPM: npm i azure-ad-jwt-lite

Do not forget to install jsonwebtoken types definitions as dev dependency if you are using Typescript: npm i -D @types/jsonwebtoken.

In your authentication middleware decode and verify the token using:

import { verifyAzureToken } from 'azure-ad-jwt-lite';

const decoded = verifyAzureToken(token);

You can add any option supported by jsonwebtoken:

import { verifyAzureToken } from 'azure-ad-jwt-lite';

const decoded = verifyAzureToken(token, {
  audience: process.env.JWT_AUD,
  issuer: process.env.JWT_ISS,
});

Additional options

import { verifyAzureToken } from 'azure-ad-jwt-lite';

const decoded = verifyAzureToken(token, {
  discoveryUrl: `https://login.microsoftonline.com/${process.env.TENANT}/discovery/keys?appid=${process.env.APP_ID}`,
  maxRetries: 5,
  audience: process.env.JWT_AUD,
  issuer: process.env.JWT_ISS,
});

Caching keys

Public keys from discovery endpoint calls are cached for a default TTL of 5 minutes.

You can disable caching using useCache: false in options, or modify TTL using cacheTtl option.

Error reference

The lib will throw the following errors if something wrong happends during decoding token:

  • InvalidToken: the token provided is not a non-empty string.
  • TokenNotDecoded: the token cannot be decoded. This usually means the token is ill-formed.
  • MissingKeyID: no kid (Microsoft Key ID) field is present in JWT header.
  • ErrorFetchingKeys: API call to fetch Microsoft public keys failed.
  • NotMatchingKey: no matching key is found in Microsoft response.
  • JsonWebTokenError: token cannot be verified, the human-readable reason is provided (expired, audience mismatch etc...)
No alternatives found
No tutorials found
Add a tutorial
No dependencies found

Rate & Review

100
No reviews found
Be the first to rate