express-openid-connect
    Preparing search index...

    Interface RequestContext

    The request authentication context found on the Express request when OpenID Connect auth middleware is added to your application.

    app.use(auth());

    app.get('/profile', (req, res) => {
      const user = req.oidc.user;
      ...
    })
    interface RequestContext {
        accessToken?: AccessToken;
        buildSessionTransferRedirect?: (
            targetLoginUrl: string,
            result: SessionTransferTokenResult,
            opts?: SessionTransferRedirectOptions,
        ) => string;
        customTokenExchange?: (
            options?: CustomTokenExchangeOptions,
        ) => Promise<TokenExchangeResponse>;
        idToken?: string;
        idTokenClaims?: IdTokenClaims;
        isAuthenticated: () => boolean;
        refreshToken?: string;
        requestSessionTransferToken?: (
            options: SessionTransferTokenOptions,
        ) => Promise<SessionTransferTokenResult>;
        user?: Record<string, any>;
        fetchUserInfo(): Promise<UserInfoResponse>;
    }
    Index
    accessToken? buildSessionTransferRedirect? customTokenExchange? idToken? idTokenClaims? isAuthenticated refreshToken? requestSessionTransferToken? user?
    fetchUserInfo
    accessToken?: AccessToken

    Credentials that can be used by an application to access an API.

    See: https://auth0.com/docs/protocols/oidc#access-tokens

    buildSessionTransferRedirect?: (
        targetLoginUrl: string,
        result: SessionTransferTokenResult,
        opts?: SessionTransferRedirectOptions,
    ) => string

    Builds the redirect URL that hands the STT to the target app's login endpoint.

    Returns targetLoginUrl?session_transfer_token=<encoded>[&organization=…]. The developer passes the returned URL to res.redirect().

    const url = req.oidc.buildSessionTransferRedirect('https://app.example.com/login', result, {
      organization: 'org_globex',
    });
    res.redirect(url);

    The targetLoginUrl must be a trusted, app-controlled value — never derive it from untrusted input such as a query parameter, as the STT would be forwarded to an attacker-controlled host. The URL must use https: (http: is accepted only for localhost, 127.0.0.1, and [::1] to support local development); any other scheme or non-loopback http: host throws a TypeError.

    customTokenExchange?: (
        options?: CustomTokenExchangeOptions,
    ) => Promise<TokenExchangeResponse>

    Performs a token exchange (RFC 8693) using the token endpoint.

    app.get('/api', requiresAuth(), async (req, res) => {
      const tokenSet = await req.oidc.customTokenExchange({
        audience: 'https://downstream-api.example.com',
      });
      res.json({ access_token: tokenSet.access_token });
    });

    Errors thrown:

    • HTTP 400 — AS rejected the request or subject_token could not be resolved (no session or no access token). err.error contains the OAuth error code
    • HTTP 401 — AS requires MFA step-up, err.error === 'mfa_required'

    Vendor-specific parameters must be passed via extra.

    idToken?: string

    The OpenID Connect ID Token.

    See: https://auth0.com/docs/protocols/oidc#id-tokens

    idTokenClaims?: IdTokenClaims

    An object containing all the claims of the ID Token.

    isAuthenticated: () => boolean

    Method to check the user's authenticated state, returns true if logged in.

    refreshToken?: string

    Credentials that can be used to refresh an access token.

    See: https://auth0.com/docs/tokens/concepts/refresh-tokens

    requestSessionTransferToken?: (
        options: SessionTransferTokenOptions,
    ) => Promise<SessionTransferTokenResult>

    Requests a Session Transfer Token (STT) for impersonation via session transfer.

    Performs a CTE call against the urn:{domain}:session_transfer audience. The agent's session id_token is used as the actor automatically (refreshed if expired); pass actor_token to override.

    The returned STT is opaque and single-use (~60s). Pass it to buildSessionTransferRedirect — never decode or store it.

    app.post('/impersonate', requiresAuth(), async (req, res) => {
      const result = await req.oidc.requestSessionTransferToken({
        subject_token: req.body.customerToken,
        subject_token_type: 'urn:mycompany:customer-subject',
        extra: { reason: 'Investigating ticket TCK-1234' },
      });
      res.redirect(req.oidc.buildSessionTransferRedirect('https://app.example.com/login', result));
    });

    Errors thrown:

    • error: 'actor_unavailable' (HTTP 400) — no actor resolved (agent not authenticated or session expired with no refresh token)
    • error: 'setactor_required' (HTTP 400) — CTE Action did not call setActor
    • error: 'session_transfer_disabled' (HTTP 400) — tenant feature flag is off
    • error: 'invalid_token_response' (HTTP 500) — AS returned an unexpected issued_token_type (not the STT URN)
    user?: Record<string, any>

    An object containing all the claims of the ID Token with the claims specified in identityClaimFilter removed.

    • Fetches the OIDC userinfo response.

      app.use(auth());

      app.get('/user-info', async (req, res) => {
        const userInfo = await req.oidc.fetchUserInfo();
        res.json(userInfo);
      })

      Returns Promise<UserInfoResponse>

    Settings
    Member Visibility

    On This Page
    Properties
    Methods