@nihplod/sso-verify 1.0.0 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -14
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,18 +1,18 @@
|
|
|
1
1
|
# @nihplod/sso-verify
|
|
2
2
|
|
|
3
|
-
NIHPLOD
|
|
3
|
+
NIHPLOD SSO token verification toolkit — for sub-projects to validate access tokens issued by the main site backend.
|
|
4
4
|
|
|
5
|
-
##
|
|
5
|
+
## Install
|
|
6
6
|
|
|
7
7
|
```bash
|
|
8
8
|
npm install @nihplod/sso-verify
|
|
9
9
|
```
|
|
10
10
|
|
|
11
|
-
##
|
|
11
|
+
## Usage
|
|
12
12
|
|
|
13
|
-
###
|
|
13
|
+
### Method 1: Introspection (Recommended)
|
|
14
14
|
|
|
15
|
-
|
|
15
|
+
Suitable for all sub-projects; no signing keys required.
|
|
16
16
|
|
|
17
17
|
```typescript
|
|
18
18
|
import { createTokenVerifier } from "@nihplod/sso-verify";
|
|
@@ -27,13 +27,13 @@ const verifier = createTokenVerifier({
|
|
|
27
27
|
|
|
28
28
|
const payload = await verifier.verify(token);
|
|
29
29
|
if (payload) {
|
|
30
|
-
console.log(payload.sub); //
|
|
30
|
+
console.log(payload.sub); // User ID
|
|
31
31
|
}
|
|
32
32
|
```
|
|
33
33
|
|
|
34
|
-
###
|
|
34
|
+
### Method 2: Local JWT Verification (Internal Confidential Clients Only)
|
|
35
35
|
|
|
36
|
-
|
|
36
|
+
Only use this when the sub-project shares `JWT_ACCESS_SECRET` with the main site.
|
|
37
37
|
|
|
38
38
|
```typescript
|
|
39
39
|
import { createTokenVerifier } from "@nihplod/sso-verify";
|
|
@@ -47,7 +47,7 @@ const verifier = createTokenVerifier({
|
|
|
47
47
|
const payload = await verifier.verify(token);
|
|
48
48
|
```
|
|
49
49
|
|
|
50
|
-
## Express / Connect
|
|
50
|
+
## Express / Connect Middleware
|
|
51
51
|
|
|
52
52
|
```typescript
|
|
53
53
|
import { ssoMiddleware } from "@nihplod/sso-verify";
|
|
@@ -63,10 +63,10 @@ app.use(
|
|
|
63
63
|
);
|
|
64
64
|
```
|
|
65
65
|
|
|
66
|
-
|
|
66
|
+
After successful verification, the token payload is attached to `req.user`.
|
|
67
67
|
|
|
68
|
-
##
|
|
68
|
+
## Notes
|
|
69
69
|
|
|
70
|
-
-
|
|
71
|
-
-
|
|
72
|
-
-
|
|
70
|
+
- The main site currently uses HS256 symmetric signing by default. For external sub-projects, we recommend verifying access tokens via **Introspection**.
|
|
71
|
+
- If your sub-project is an internal service and already shares the RS256 public key with the main site, you can configure `accessTokenPublicKey` or `jwksUri` for local JWT verification.
|
|
72
|
+
- **Never distribute `JWT_ACCESS_SECRET` (the HS256 symmetric key) to external sub-projects.**
|