Auth0 Express

开发编程需配置 API Key

用于在Express.js Web 应用中添加身份验证（登录、登出、受保护路由），集成 express-openid-connect 实现基于会话的身份验证。

后端开发

524

下载量

安装量

收藏量

★ 5.0

综合评分ⓘ

概述

更多信息

Auth0 Express Integration#

Add authentication to Express.js web applications using express-openid-connect.

Prerequisites#

Express.js application
Auth0 account and application configured
If you don't have Auth0 set up yet, use the auth0-quickstart skill first

When NOT to Use#

Single Page Applications - Use auth0-react, auth0-vue, or auth0-angular for client-side auth
Next.js applications - Use auth0-nextjs skill which handles both client and server
Mobile applications - Use auth0-react-native for React Native/Expo
Stateless APIs - Use JWT validation middleware instead of session-based auth
Microservices - Use JWT validation for service-to-service auth

Quick Start Workflow#

1. Install SDK#

bash

npm install express-openid-connect dotenv

2. Configure Environment#

For automated setup with Auth0 CLI, see Setup Guide for complete scripts.

For manual setup:

Create .env:

bash

SECRET=<openssl-rand-hex-32>
BASE_URL=http://localhost:3000
CLIENT_ID=your-client-id
CLIENT_SECRET=your-client-secret
ISSUER_BASE_URL=https://your-tenant.auth0.com

Generate secret: openssl rand -hex 32

3. Configure Auth Middleware#

Update your Express app ( app.js or index.js):

javascript

require('dotenv').config();
const express = require('express');
const { auth, requiresAuth } = require('express-openid-connect');

const app = express();

// Configure Auth0 middleware
app.use(auth({
  authRequired: false,  // Don't require auth for all routes
  auth0Logout: true,    // Enable logout endpoint
  secret: process.env.SECRET,
  baseURL: process.env.BASE_URL,
  clientID: process.env.CLIENT_ID,
  issuerBaseURL: process.env.ISSUER_BASE_URL,
  clientSecret: process.env.CLIENT_SECRET
}));

app.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});

This automatically creates:

/login - Login endpoint
/logout - Logout endpoint
/callback - OAuth callback

4. Add Routes#

javascript

// Public route
app.get('/', (req, res) => {
  res.send(req.oidc.isAuthenticated() ? 'Logged in' : 'Logged out');
});

// Protected route
app.get('/profile', requiresAuth(), (req, res) => {
  res.send(`
    <h1>Profile</h1>
    <p>Name: ${req.oidc.user.name}</p>
    <p>Email: ${req.oidc.user.email}</p>
    <pre>${JSON.stringify(req.oidc.user, null, 2)}</pre>
    <a href="/logout">Logout</a>
  `);
});

// Login/logout links
app.get('/', (req, res) => {
  res.send(`
    ${req.oidc.isAuthenticated() ? `
      <p>Welcome, ${req.oidc.user.name}!</p>
      <a href="/profile">Profile</a>
      <a href="/logout">Logout</a>
    ` : `
      <a href="/login">Login</a>
    `}
  `);
});

5. Test Authentication#

Start your server:

bash

node app.js

Visit http://localhost:3000 and test the login flow.

Detailed Documentation#

Setup Guide - Automated setup scripts, environment configuration, Auth0 CLI usage
Integration Guide - Protected routes, sessions, API integration, error handling
API Reference - Complete middleware API, configuration options, request properties

Common Mistakes#

MistakeFixForgot to add callback URL in Auth0 DashboardAdd /callback path to Allowed Callback URLs (e.g., http://localhost:3000/callback)Missing or weak SECRETGenerate secure secret with openssl rand -hex 32 and store in .env as SECRETSetting authRequired: true globallySet to false and use requiresAuth() middleware on specific routesApp created as SPA type in Auth0Must be Regular Web Application type for server-side authSession secret exposed in codeAlways use environment variables, never hardcode secretsWrong baseURL for productionUpdate BASE_URL to match your production domainNot handling logout returnToAdd your domain to Allowed Logout URLs in Auth0 Dashboard