express-oauth2-jwt-bearer

Can be used in 2 ways:

1. Pass in an AuthOptions.issuerBaseURL (or define the env variable ISSUER_BASE_URL)

app.use(auth({
  issuerBaseURL: 'http://issuer.example.com',
  audience: 'https://myapi.com'
}));

This uses the AuthOptions.issuerBaseURL to find the OAuth 2.0 Authorization Server Metadata to get the AuthOptions.jwksUri and AuthOptions.issuer.

2. You can also skip discovery and provide the AuthOptions.jwksUri (or define the env variable JWKS_URI) and AuthOptions.issuer (or define the env variable ISSUER) yourself.

app.use(auth({
  jwksUri: 'http://issuer.example.com/well-known/jwks.json',
  issuer: 'http://issuer.example.com',
  audience: 'https://myapi.com'
}));

You must provide the audience argument (or AUDIENCE environment variable) used to match against the Access Token's aud claim.

app.use(auth());

app.get('/admin/edit', claimCheck((claims) => {
  return claims.isAdmin && claims.roles.includes('editor');
}, `Unexpected 'isAdmin' and 'roles' claims`), (req, res) => { ... });

app.use(auth());

app.get('/admin', claimEquals('isAdmin', true), (req, res) => { ... });

app.use(auth());

app.get('/admin/edit', claimIncludes('role', 'admin', 'editor'),
   (req, res) => { ... });

app.use(auth());

app.get('/admin/edit', requiredScopes('read:admin write:admin'),
   (req, res) => { ... });

app.use(auth());

app.get('/admin/edit', scopeIncludesAny('read:msg read:admin'),
   (req, res) => { ... });