OAuthorize

OAuthorize is a service provider toolkit for Node.js. It provides a suite of middleware that, combined with application-specific route handlers, can be used to assemble a server that implements the OAuth 1.0 protocol.

Installation

$ npm install oauthorize

Usage

While OAuth is a rather intricate protocol, at a high level there are three classes of endpoints from an implementation perspective, based on how those endpoints are authenticated. OAuthorize middleware, protected by Passport authentication strategies including passport-http-oauth, is used to authenticate clients, obtain authorization from users, and issue access tokens.

Create an OAuth Server

Call createServer() to create a new OAuth server. This instance exposes middleware that will be mounted in routes, as well as configuration options.

var server = oauthorize.createServer();

Implement Token Endpoints

Clients (aka consumers) interact with token endpoints directly in order to obtain tokens. First, a client retrieves an unauthorized request token.

app.post('/request_token',
  passport.authenticate('consumer', { session: false }),
  server.requestToken(function(client, callbackURL, done) {
    var token = utils.uid(8)
      , secret = utils.uid(32)

    var t = new RequestToken(token, secret, client.id, callbackURL);
    t.save(function(err) {
      if (err) { return done(err); }
      return done(null, token, secret);
    });
  }));

After a user has authorized this token, it can be exchanged for an access token.

app.post('/access_token',
  passport.authenticate('consumer', { session: false }),
  server.accessToken(
    function(requestToken, verifier, info, done) {
      if (verifier != info.verifier) { return done(null, false); }
      return done(null, true);
    },
    function(client, requestToken, info, done) {
      if (!info.authorized) { return done(null, false); }
      if (client.id !== info.clientId) { return done(null, false); }

      var token = utils.uid(32)
        , secret = utils.uid(128)
      var t = new AccessToken(token, secret, info.userId, info.clientId);
      t.save(function(err) {
        if (err) { return done(err); }
        return done(null, token, secret);
      });
    }
  ));

Implement User Authorization Endpoints

In order to authorize the request token, the client will redirect the user to the user authorization endpoint.

app.get('/dialog/authorize',
  login.ensureLoggedIn(),
  server.userAuthorization(function(requestToken, done) {
    RequestToken.findOne(requestToken, function(err, token) {
      if (err) { return done(err); }
      Clients.findOne(token.clientId, function(err, client) {
        if (err) { return done(err); }
        return done(null, client, token.callbackUrl);
      });
    });
  }),
  function(req, res){
    res.render('dialog', { transactionID: req.oauth.transactionID,
                           client: req.oauth.client, user: req.user });
  });

The application is responsible for authenticating the user (in this case, using connect-ensure-login middleware) and obtaining their consent by rendering a form.

The user must choose to allow access, optionally limited to a narrower scope or duration of access. The form submission can be processed by user decision middleware.

app.post('/dialog/authorize/decision',
  login.ensureLoggedIn(),
  server.userDecision(function(requestToken, user, done) {
    RequestToken.findOne(requestToken, function(err, token) {
      if (err) { return done(err); }
      var verifier = utils.uid(8);
      token.authorized = true;
      token.userId = user.id;
      token.verifier = verifier;
      token.save(function(err) {
        if (err) { return done(err); }
        return done(null, verifier);
      });
    });
  }));

Once authorized, the client can exchange the request token for an access token the token endpoint described above.

Implement API Endpoints

Once an access token has been issued, a client will use it to make API requests on behalf of the user.

app.get('/api/userinfo', 
  passport.authenticate('token', { session: false }),
  function(req, res) {
    res.json(req.user);
  });

Session Serialization

Obtaining the user's authorization involves multiple request/response pairs. During this time, an OAuth transaction will be serialized to the session. Client serialization functions are registered to customize this process, which will typically be as simple as serializing the client ID, and finding the client by ID when deserializing.

server.serializeClient(function(client, done) {
  return done(null, client.id);
});

server.deserializeClient(function(id, done) {
  Clients.findOne(id, function(err, client) {
    if (err) { return done(err); }
    return done(null, client);
  });
});

Examples

This example demonstrates how to implement an OAuth service provider, complete with protected API access.

Tests

$ npm install --dev
$ make test

Credits

Jared Hanson

License

(The MIT License)

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

mccormicka/oauthorize