All Projects → auth0-community → Auth0 Socketio Jwt

auth0-community / Auth0 Socketio Jwt

Licence: mit
Authenticate socket.io incoming connections with JWTs

Programming Languages

javascript
184084 projects - #8 most used programming language

Projects that are alternatives of or similar to Auth0 Socketio Jwt

Ember Simple Auth Auth0
Auth0 + lock.js, built on ember-simple-auth
Stars: ✭ 53 (-95.15%)
Mutual labels:  community-driven, open-source, identity, auth0
auth0-xamarin-oidc-samples
Auth0 OIDC Client with Xamarin applications
Stars: ✭ 26 (-97.62%)
Mutual labels:  identity, auth0, community-driven
Authing
🔥Authing - IDaaS/IAM solution that can Auth to web and mobile applications.
Stars: ✭ 247 (-77.4%)
Mutual labels:  jwt, identity, auth0
Lock.swift
A Swift & iOS framework to authenticate using Auth0 and with a Native Look & Feel
Stars: ✭ 215 (-80.33%)
Mutual labels:  jwt, auth0
Cfworker
A collection of packages optimized for Cloudflare Workers and service workers.
Stars: ✭ 152 (-86.09%)
Mutual labels:  jwt, auth0
Security.identity
.NET DevPack Identity is a set of common implementations to help you implementing Identity, Jwt, claims validation and another facilities
Stars: ✭ 165 (-84.9%)
Mutual labels:  jwt, identity
Django Auth0 Vue
A Django REST Framework + Vue.js CRUD Demo Secured Using Auth0
Stars: ✭ 99 (-90.94%)
Mutual labels:  jwt, auth0
Aspnetcore2jwtauthentication
Jwt Authentication without ASP.NET Core Identity
Stars: ✭ 218 (-80.05%)
Mutual labels:  jwt, identity
Rox
🌍 BeWelcome lets you share a place to stay, connect with travellers, meet up and find accommodation on your journey. It is and will always be a free, open source, non for profit, democratic community.
Stars: ✭ 95 (-91.31%)
Mutual labels:  community-driven, open-source
Aspnetcore Webapi Course
Professional REST API design with ASP.NET Core 3.1 WebAPI
Stars: ✭ 323 (-70.45%)
Mutual labels:  jwt, identity
Aspnetcoreapistarter
An ASP.NET Core (v2.1) Web API project to quickly bootstrap new projects. Includes Identity, JWT authentication w/ refresh tokens.
Stars: ✭ 304 (-72.19%)
Mutual labels:  jwt, identity
Cloudfront Auth
An AWS CloudFront [email protected] function to authenticate requests using Google Apps, Microsoft, Auth0, OKTA, and GitHub login
Stars: ✭ 471 (-56.91%)
Mutual labels:  jwt, auth0
Auth0.swift
Swift toolkit for Auth0 API
Stars: ✭ 146 (-86.64%)
Mutual labels:  jwt, auth0
Reactjs Authentication Tutorial
Chuck Norris World App - A sample app that shows how to add authentication to a ReactJS app
Stars: ✭ 139 (-87.28%)
Mutual labels:  jwt, auth0
Zitadel
ZITADEL - Cloud Native Identity and Access Management
Stars: ✭ 105 (-90.39%)
Mutual labels:  jwt, identity
Auth0.js
Auth0 headless browser sdk
Stars: ✭ 755 (-30.92%)
Mutual labels:  jwt, auth0
Aspnetcore Ddd
Full ASP.NET Core 3.1 LTS application with DDD, CQRS and Event Sourcing
Stars: ✭ 88 (-91.95%)
Mutual labels:  jwt, identity
Ethr Did
Create ethr DIDs
Stars: ✭ 90 (-91.77%)
Mutual labels:  jwt, identity
Maxkey
MaxKey is Single Sign On(SSO) System,Leading-Edge Enterprise-Class open source IAM(Identity and Access management) product.
Stars: ✭ 274 (-74.93%)
Mutual labels:  open-source, jwt
Pizzaql
🍕 Modern OSS Order Management System for Pizza Restaurants
Stars: ✭ 631 (-42.27%)
Mutual labels:  open-source, auth0

socketio-jwt

All Contributors

Contributors

Thanks goes to these wonderful people who contribute(d) or maintain(ed) this repo (emoji key):

Conrad Sopala
Conrad Sopala

👀 🚧
Annyv2
Annyv2

💻
Vladyslav Martynets
Vladyslav Martynets

💻
Alberto Pose
Alberto Pose

💻
Root-Core
Root-Core

💻

Intro

Authenticate socket.io incoming connections with JWTs. This is useful if you are building a single page application and you are not using cookies as explained in this blog post: Cookies vs Tokens. Getting auth right with Angular.JS.

This repo is supported and maintained by Community Developers, not Auth0. For more information about different support levels check https://auth0.com/docs/support/matrix .

Installation

npm install socketio-jwt

Usage

// set authorization for socket.io
io.sockets
  .on('connection', socketioJwt.authorize({
    secret: 'your secret or public key',
    timeout: 15000 // 15 seconds to send the authentication message
  }))
  .on('authenticated', (socket) => {
    //this socket is authenticated, we are good to handle more events from it.
    console.log(`hello! ${socket.decoded_token.name}`);
  });

Note: If you are using a base64-encoded secret (e.g. your Auth0 secret key), you need to convert it to a Buffer: Buffer('your secret key', 'base64')

Client side

const socket = io.connect('http://localhost:9000');
socket.on('connect', () => {
  socket
    .emit('authenticate', { token: jwt }) //send the jwt
    .on('authenticated', () => {
      //do other things
    })
    .on('unauthorized', (msg) => {
      console.log(`unauthorized: ${JSON.stringify(msg.data)}`);
      throw new Error(msg.data.type);
    })
});

One roundtrip

The previous approach uses a second roundtrip to send the jwt. There is a way you can authenticate on the handshake by sending the JWT as a query string, the caveat is that intermediary HTTP servers can log the url.

const io            = require('socket.io')(server);
const socketioJwt   = require('socketio-jwt');

With socket.io < 1.0:

io.set('authorization', socketioJwt.authorize({
  secret: 'your secret or public key',
  handshake: true
}));

io.on('connection', (socket) => {
  console.log('hello!', socket.handshake.decoded_token.name);
});

With socket.io >= 1.0:

io.use(socketioJwt.authorize({
  secret: 'your secret or public key',
  handshake: true
}));

io.on('connection', (socket) => {
  console.log('hello!', socket.decoded_token.name);
});

For more validation options see auth0/jsonwebtoken.

Client side

Append the jwt token using query string:

const socket = io.connect('http://localhost:9000', {
  query: `token=${your_jwt}`
});

Append the jwt token using 'Authorization Header' (Bearer Token):

const socket = io.connect('http://localhost:9000', {
  extraHeaders: { Authorization: `Bearer ${your_jwt}` }
});

Both options can be combined or used optionally.

Authorization Header Requirement

Require Bearer Tokens to be passed in as an Authorization Header

Server side:

io.use(socketioJwt.authorize({
  secret: 'your secret or public key',
  handshake: true,
  auth_header_required: true
}));

Handling token expiration

Server side

When you sign the token with an expiration time (example: 60 minutes):

const token = jwt.sign(user_profile, jwt_secret, { expiresIn: 60*60 });

Your client-side code should handle it as below:

Client side

socket.on('unauthorized', (error) => {
  if (error.data.type == 'UnauthorizedError' || error.data.code == 'invalid_token') {
    // redirect user to login page perhaps?
    console.log('User token has expired');
  }
});

Handling invalid token

Token sent by client is invalid.

Server side:

No further configuration needed.

Client side

Add a callback client-side to execute socket disconnect server-side.

socket.on('unauthorized', (error, callback) => {
  if (error.data.type == 'UnauthorizedError' || error.data.code == 'invalid_token') {
    // redirect user to login page perhaps or execute callback:
    callback();
    console.log('User token has expired');
  }
});

Server side

To disconnect socket server-side without client-side callback:

io.sockets.on('connection', socketioJwt.authorize({
  secret: 'secret goes here',
  // No client-side callback, terminate connection server-side
  callback: false
}))

Client side

Nothing needs to be changed client-side if callback is false.

Server side

To disconnect socket server-side while giving client-side 15 seconds to execute callback:

io.sockets.on('connection', socketioJwt.authorize({
  secret: 'secret goes here',
  // Delay server-side socket disconnect to wait for client-side callback
  callback: 15000
}))

Your client-side code should handle it as below:

Client side

socket.on('unauthorized', (error, callback) => {
  if (error.data.type == 'UnauthorizedError' || error.data.code == 'invalid_token') {
    // redirect user to login page perhaps or execute callback:
    callback();
    console.log('User token has expired');
  }
});

Getting the secret dynamically

You can pass a function instead of a string when configuring secret. This function receives the request, the decoded token and a callback. This way, you are allowed to use a different secret based on the request and / or the provided token.

Server side

const SECRETS = {
  'user1': 'secret 1',
  'user2': 'secret 2'
}

io.use(socketioJwt.authorize({
  secret: (request, decodedToken, callback) => {
    // SECRETS[decodedToken.userId] will be used as a secret or
    // public key for connection user.

    callback(null, SECRETS[decodedToken.userId]);
  },
  handshake: false
}));

Altering the value of the decoded token

You can pass a function to change the value of the decoded token

io.on(
  'connection',
  socketIOJwt.authorize({
    customDecoded: (decoded) => {
      return "new decoded token";
    },
    secret: 'my_secret_key',
    decodedPropertyName: 'my_decoded_token',
  }),
);

io.on('authenticated', (socket) => {
  console.log(socket.my_decoded_token); // new decoded token
});

Contribute

Feel like contributing to this repo? We're glad to hear that! Before you start contributing please visit our Contributing Guideline.

Here you can also find the PR template to fill once creating a PR. It will automatically appear once you open a pull request.

You might run the unit tests, before creating a PR:

npm test

Issues Reporting

Spotted a bug or any other kind of issue? We're just humans and we're always waiting for constructive feedback! Check our section on how to report issues!

Here you can also find the Issue template to fill once opening a new issue. It will automatically appear once you create an issue.

Repo Community

Feel like PRs and issues are not enough? Want to dive into further discussion about the tool? We created topics for each Auth0 Community repo so that you can join discussion on stack available on our repos. Here it is for this one: socketio-jwt

License

This project is licensed under the MIT license. See the LICENSE file for more info.

What is Auth0?

Auth0 helps you to:

  • Add authentication with multiple authentication sources, either social like

    • Google
    • Facebook
    • Microsoft
    • Linkedin
    • GitHub
    • Twitter
    • Box
    • Salesforce
    • etc.

    or enterprise identity systems like:

    • Windows Azure AD
    • Google Apps
    • Active Directory
    • ADFS
    • Any SAML Identity Provider
  • Add authentication through more traditional username/password databases

  • Add support for linking different user accounts with the same user

  • Support for generating signed JSON Web Tokens to call your APIs and create user identity flow securely

  • Analytics of how, when and where users are logging in

  • Pull data from other sources and add it to user profile, through JavaScript rules

Create a free Auth0 account

  • Go to Auth0 website
  • Hit the SIGN UP button in the upper-right corner
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].