Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Learn OAuth by building a client with Node.js

annotate.dev

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Learn OAuth by building a client with Node.js

#21

Post by moltar »

e1g wrote: post #13

For those looking for production-level OAuth libs, the best implementation for all JS runtimes is https://github.com/panva/oauth4webapi Certified, thoroughly tested, zero deps, fully typed, secure defaults, works in Node/Deno/Bun/Edge, supports PKCE/dPoP/etc.

Out of scope

The following features are currently out of scope:

CommonJS

Can’t be the best if CJS support is not offered. I know everyone’s hot for ESM but the fact of the matter is that there is an endless supply of legacy projects that will never migrate to ESM. Deliberately eliminating huge swath of potential users is IMO hostile. Especially because there are tools like tsup that can cross build out of the box.

Re: Learn OAuth by building a client with Node.js

#22

Post by azophy_2 »

beanjuiceII wrote: post #16
e1g wrote: post #13

For those looking for production-level OAuth libs, the best implementation for all JS runtimes is https://github.com/panva/oauth4webapi Certified, thoroughly tested, zero deps, fully typed, secure defaults, works in Node/Deno/Bun/Edge, supports PKCE/dPoP/etc.

Certified by the person who wrote the library? I guess I also certify it

certified by OpenID foundation: https://openid.net/wp-content/uploads/2024/01/oidcc-client-b...

Re: Learn OAuth by building a client with Node.js

#23

Post by YawningAngel »

fulafel wrote: post #19

In what cases is this kindof plain auth code flow still considered good enough from security POV? There's advice eg https://www.oauth.com/oauth2-servers/pkce/ that seems to say you should PKCE it even in server-side auth code flow use cases: > PKCE was originally designed to protect the authorization code flow in mobile apps, and was later recommended to be used by single-page apps as well. In later years, it was rec…

It's secure as long as you are using a private client (one that can safeguard a client secret), but PKCE costs you nothing to it's strictly better to do it.

Re: Learn OAuth by building a client with Node.js

#24

Post by tip_of_the_hat »

akira2501 wrote: post #12
tip_of_the_hat wrote: post #2

Hey HN, author here. When I was first learning OAuth, I found that all the guides were text-heavy and lacked code. I personally learn better from code, so I created a code-first guide. Let me know if you have any feedback!

It's a decent skeleton for a server side client. You might consider showing how a token refresh might work. There is often a need for public client side implementations as well. Are you planning on making one there? It's mostly the same idea but you do the redirects yourself with CSRF and PKCE.

Yup, planning on expanding to add a PKCE and OIDC walkthroughs as well!

Re: Learn OAuth by building a client with Node.js

#25

Post by andrewstuart »

This is really great I learn best from this sort of thing - a bare bones code implementation.

Only suggestions …. add some more providers, some minimal client side code and show how to get some data from the provider api with the token and how to refresh it.

Re: Learn OAuth by building a client with Node.js

#26

Post by bookmark99 »

I'm learning OAuth right now and this is great!

It's simple with barebones implementations. I'm trying to now learn the server (OAuth provider) side aspect of things so if anyone has any good guides I'd highly appreciate! Alot of the stuff we see in the client side we take for granted e.g redirecting user back to the client? Generating Access tokens? Generating OAuth tokens, verification of identity etc etc.

Any help is appreciated!

Re: Learn OAuth by building a client with Node.js

#27

Post by sureglymop »

willsmith72 wrote: post #14

at my old company we worked with auth a lot, so it was a requirement for new joiners to watch this in their first week. i still recommend it if you want to learn oauth from 0 https://www.youtube.com/watch?v=996OiexHze0

This one is very good! I have recommended it countless people at work.

Re: Learn OAuth by building a client with Node.js

#28

Post by _panva »

beanjuiceII wrote: post #16
e1g wrote: post #13

For those looking for production-level OAuth libs, the best implementation for all JS runtimes is https://github.com/panva/oauth4webapi Certified, thoroughly tested, zero deps, fully typed, secure defaults, works in Node/Deno/Bun/Edge, supports PKCE/dPoP/etc.

Certified by the person who wrote the library? I guess I also certify it

In self-certification processes like the OIDC certification program, it's common for developers to certify their own software. This is because the process is designed for developers to evaluate their own implementations against the established standards and requirements set by the certification program.

Self-certification doesn't mean that the process lacks validity or rigor. On the contrary, it involves thorough testing and validation against industry standards to ensure that the software meets the necessary criteria for interoperability, security, and functionality.

If you're curious about the specifics of the process, you can find more information on the OIDC certification FAQ pages. These resources provide detailed explanations of the certification process, the criteria for certification, and the testing procedures involved.

Re: Learn OAuth by building a client with Node.js

#29

Post by _panva »

moltar wrote: post #21
e1g wrote: post #13

For those looking for production-level OAuth libs, the best implementation for all JS runtimes is https://github.com/panva/oauth4webapi Certified, thoroughly tested, zero deps, fully typed, secure defaults, works in Node/Deno/Bun/Edge, supports PKCE/dPoP/etc.

Out of scope The following features are currently out of scope: CommonJS Can’t be the best if CJS support is not offered. I know everyone’s hot for ESM but the fact of the matter is that there is an endless supply of legacy projects that will never migrate to ESM. Deliberately eliminating huge swath of potential users is IMO hostile. Especially because there are tools like tsup that can cross build out of the box.

All target runtimes of oauth4webapi natively support ESM. Furthermore, experimental "require(esm)" is coming with Node.js 22 in the coming days, giving library authors such as myself even less of a need to bother with CJS targets, publishing, dual CJS/ESM hassles and more. See https://joyeecheung.github.io/blog/2024/03/18/require-esm-in...
Post reply on HN