Securing your node.js Express application with OneGraph JWTs

You can try this example in CodeSandbox or fork the GitHub repository

We can integrate OneGraph's JWTs in our express app with a single function thanks to the excellent express-jwt middleware available:

yarn add express-jwt express-jwt-permissions jwks-rsa

const jwt = require("express-jwt");
const jwksRsa = require("jwks-rsa");

const ONEGRAPH_APP_ID = process.env.ONEGRAPH_APP_ID;

const jwtMiddleware = options => {
  const { credentialsRequired, appId } = options;

  const secret =
    options.secret ||
    // By default, use the zero-config JWKs to verify
    jwksRsa.expressJwtSecret({
      cache: true,
      rateLimit: true,
      jwksRequestsPerMinute: 1,
      jwksUri: `https://serve.onegraph.com/app/${appId}/.well-known/jwks.json`
    });

  return jwt({
    secret: secret,
    issuer: "OneGraph",
    audience: `https://serve.onegraph.com/dashboard/app/${appId}`,
    userProperty: "jwt",
    credentialsRequired: credentialsRequired
  });
};

Now we make use of our middleware:

app.use(
  jwtMiddleware({
    appId: ONEGRAPH_APP_ID,
    credentialsRequired: false
  })
);

And guard any routes we want to protect:

const guard = require("express-jwt-permissions")({ requestProperty: "jwt" });
// Note that express-jwt-permissions expects a jwt with the minimum structure:
// {permissions: []}
// See https://github.com/MichielDeMey/express-jwt-permissions#error-handling for customization options
app.get("/restricted", guard.check(["admin"]), function(req, res) {
  const reqJson = JSON.stringify(req.jwt, null, 2);
  res.write(reqJson); //write a response to the client
  res.end(); //end the response
});

Note that for any unguarded route, req.jwt may be null (in other words, users may be unauthenticated):

app.get("/", function(req, res) {
  // Since this route is unguarded, `req.jwt` may be null
  const jwt = req.jwt || {};

  const reqJson = JSON.stringify(jwt, null, 2);
  res.write(reqJson); //write a response to the client
  res.end(); //end the response
});

AuthGuardian support

AuthGuardian has excellent support for express-jwt-permissions. For any rule, simply Add to list at path (with path set to permissions).

Consider this scenario:

I want to restrict access to a route in my express server so that only members of my GitHub organization can access them.

We can configured AuthGuardian with th following rule:

And simply add a guard check for the admin permission on our restricted route:

app.get("/restricted", guard.check(["admin"]), function(req, res) {
   // Only users who are logged in *and* members of the 'OneGraph' GitHub
   // organization can access this route
});

Check out the GitHub repository for the full code