@muze-nl/metro-oidc 0.3.2 → 0.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +15 -2
- package/dist/browser.js +345 -410
- package/dist/browser.js.map +4 -4
- package/dist/browser.min.js +1 -1
- package/dist/browser.min.js.map +4 -4
- package/package.json +3 -3
- package/src/oidcmw.mjs +6 -4
package/README.md
CHANGED
|
@@ -24,11 +24,24 @@ async function fetchMovies() {
|
|
|
24
24
|
````
|
|
25
25
|
|
|
26
26
|
The OIDC middleware will automatically discover the configuration of the issuer, as well as do a dynamic client registration, if you haven't set a `client_info.client_id`.
|
|
27
|
-
It will then configure the correct OAuth2 settings and handle the request with [metro oauth2](https://github.com/muze-nl/metro-oauth2) middleware. It may redirect the browser to let the user login with the OIDC issuer. You can skip the automatic configuration step, if you provide the `openid_configuration` parameter set yourself, the oidcmw middleware will only
|
|
27
|
+
It will then configure the correct OAuth2 settings and handle the request with [metro oauth2](https://github.com/muze-nl/metro-oauth2) middleware. It may redirect the browser to let the user login with the OIDC issuer. You can skip the automatic configuration step, if you provide the `openid_configuration` parameter set yourself. If you don't, the oidcmw middleware will only run the discovery process once, and store the information in localStorage. The same with the client_info and dynamic registration.
|
|
28
28
|
|
|
29
29
|
## Security features
|
|
30
30
|
|
|
31
31
|
metro.oidc uses OAuth2.1 by default, including PKCE and DPoP. The Keypair used in DPoP is created non-extractable, so they cannot be leaked. This means that the access_token and refresh_token, even if leaked, cannot be used anywhere else.
|
|
32
32
|
|
|
33
|
-
You can disable
|
|
33
|
+
You can disable PKCE by setting `options.client_info.code_verifier` to false.
|
|
34
34
|
You can disable DPoP by setting `options.use_dpop` to false.
|
|
35
|
+
|
|
36
|
+
## id_token
|
|
37
|
+
|
|
38
|
+
The metro oidc middleware doesn't use the id_token, or verify any of its contents. This is left up to you, if you need it. You can retrieve the id_token by calling the `idToken` function, after the user is logged in:
|
|
39
|
+
|
|
40
|
+
```javascript
|
|
41
|
+
import oidc from '@muze-nl/metro-oidc'
|
|
42
|
+
|
|
43
|
+
let id_token = oidc.idToken()
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
[project-stage-badge: Experimental]: https://img.shields.io/badge/Project%20Stage-Experimental-yellow.svg
|
|
47
|
+
[project-stage-page]: https://blog.pother.ca/project-stages/
|