# @passport-next/passport-oauth2
> OAuth 2.0 authentication strategy for Passport.
Latest version **2.1.4** (published 2022-11-08) · MIT license · 0 weekly downloads
## Install
```sh
npm install @passport-next/passport-oauth2
pnpm add @passport-next/passport-oauth2
yarn add @passport-next/passport-oauth2
bun add @passport-next/passport-oauth2
```
## Health
**Score 15/100 (F)** — status: abandoned.
Positive: no vulnerabilities.
Warnings: low downloads; no types; no esm support.
Negative: abandoned; low maintenance score.
## Facts
| | |
|---|---|
| Version | 2.1.4 |
| Published | 2022-11-08 |
| First published | 2018-06-29 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >= 6 |
| Dependencies | 3 |
| Unpacked size | 34.3 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 4 |
| Author | Rowan Wookey |
| Maintainers | brettz9, rwky, adamhathcock, guyellis |
| Keywords | passport, auth, authn, authentication, authz, authorization, oauth, oauth2 |
## Links
- npm: https://www.npmjs.com/package/@passport-next/passport-oauth2
- Repository: https://github.com/passport-next/passport-oauth2
- Homepage: https://github.com/passport-next/passport-oauth2#readme
- Issues: http://github.com/passport-next/passport-oauth2/issues
- npm.io page: https://npm.io/package/@passport-next/passport-oauth2
## Dependencies (3)
- [oauth](https://npm.io/package/oauth.md) 0.9.x
- [lodash](https://npm.io/package/lodash.md) ^4.17.19
- [@passport-next/passport-strategy](https://npm.io/package/@passport-next/passport-strategy.md) 1.1.x
## Alternatives
- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@oxyhq/services](https://npm.io/package/@oxyhq/services.md) — 2.3K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
## Recent versions
- 2.1.4 (latest) — 2022-11-08
- 2.1.3 — 2022-04-19
- 2.1.2 — 2021-09-28
- 2.1.1 — 2020-07-22
- 2.1.0 — 2019-12-19
- 2.0.3 — 2019-08-27
- 2.0.2 — 2019-07-13
- 2.0.1 — 2019-06-12
- 2.0.0 — 2019-02-27
- 1.7.1 — 2019-02-13
- 1.7.0 — 2018-07-07
- 1.6.0 — 2018-07-07
- 1.5.0 — 2018-06-29
## README
# passport-oauth2
[](https://app.travis-ci.com/passport-next/passport-oauth2)
[](https://coveralls.io/github/passport-next/passport-oauth2?branch=master)
[](https://codeclimate.com/github/passport-next/passport-oauth2/maintainability)
[](https://david-dm.org/passport-next/passport-oauth2)
General-purpose OAuth 2.0 authentication strategy for [Passport](http://passportjs.org/).
This module lets you authenticate using OAuth 2.0 in your Node.js applications.
By plugging into Passport, OAuth 2.0 authentication can be easily and
unobtrusively integrated into any application or framework that supports
[Connect](http://www.senchalabs.org/connect/)-style middleware, including
[Express](http://expressjs.com/).
Note that this strategy provides generic OAuth 2.0 support. In many cases, a
provider-specific strategy can be used instead, which cuts down on unnecessary
configuration, and accommodates any provider-specific quirks. See the
[list](https://github.com/jaredhanson/passport/wiki/Strategies) for supported
providers.
Developers who need to implement authentication against an OAuth 2.0 provider
that is not already supported are encouraged to sub-class this strategy. If you
choose to open source the new provider-specific strategy, please add it to the
list so other people can find it.
## Install
$ npm install @passport-next/passport-oauth2
## Usage
#### Configure Strategy
The OAuth 2.0 authentication strategy authenticates users using a third-party
account and OAuth 2.0 tokens. The provider's OAuth 2.0 endpoints, as well as
the client identifer and secret, are specified as options. The strategy
requires a `verify` callback, which receives an access token and profile,
and calls `cb` providing a user.
```js
passport.use(new OAuth2Strategy({
authorizationURL: 'https://www.example.com/oauth2/authorize',
tokenURL: 'https://www.example.com/oauth2/token',
clientID: EXAMPLE_CLIENT_ID,
clientSecret: EXAMPLE_CLIENT_SECRET,
callbackURL: "http://localhost:3000/auth/example/callback"
},
function(accessToken, refreshToken, profile, cb) {
User.findOrCreate({ exampleId: profile.id }, function (err, user) {
return cb(err, user);
});
}
));
```
#### Authenticate Requests
Use `passport.authenticate()`, specifying the `'oauth2'` strategy, to
authenticate requests.
For example, as route middleware in an [Express](http://expressjs.com/)
application:
```js
app.get('/auth/example',
passport.authenticate('oauth2'));
app.get('/auth/example/callback',
passport.authenticate('oauth2', { failureRedirect: '/login' }),
function(req, res) {
// Successful authentication, redirect home.
res.redirect('/');
});
```
## Strategy Options
#### authorizationURL
REQUIRED
`{ authorizationURL: string }`
URL used to obtain an authorization grant
#### tokenURL
REQUIRED
`{ tokenURL: string }`
URL used to obtain an access token
#### clientID
REQUIRED
`{ clientID: string }`
The client identifier issued to the client by the OAuth 2.0 service.
#### clientSecret
REQUIRED
`{ clientSecret: string }`
The client secret issued to the client by the OAuth 2.0 service.
#### callbackURL
OPTIONAL
`{ callbackURL: string }`
URL to which the service provider will redirect the user after obtaining authorization. The URL can be relative or fully qualified; when relative, the original URL of the authorization request will be prepended to the relative URL.
#### customHeaders
OPTIONAL
`{ customHeaders: Object }`
Custom headers you can pass along with the authorization request.
#### parseIdToken
OPTIONAL
`{ parseIdToken: boolean }`
When set to `true`, the id token is used to construct the user profile instead of the access token (if the authentication response also includes an id token).
#### passReqToCallback
OPTIONAL
`{ passReqToCallback: boolean }`
When set to `true`, the first argument sent to the verify callback is the request, `http.IncomingMessage`, (default: `false`)
#### proxy
OPTIONAL
`{ proxy: boolean }`
Used when resolving a relative callbackURL. When set to `true`, `req.headers['x-forwarded-proto']` and `req.headers['x-forwarded-host']` will be used otherwise `req.connection.encrypted` and `req.headers.host` will be used.
_Note_: if your webserver, e.g. `Express`, provides `req.app.get` and the value `req.app.get('trust proxy')` is set, proxy option will automatically be set to `true`.
#### scope
OPTIONAL
`{ scope: Array|string }`
The scope of the access request made by the client of the OAuth 2.0 service. The scope is a list one or more strings, which are defined by the OAuth 2.0 service.
When the scope is provided as a list of strings, each string should be separated by a single space, as per the OAuth 2.0 spec. When the scope is provided as an Array of strings, each array element will be joined by the scopeSeparator.
#### scopeSeparator
OPTIONAL
`{ scopeSeparator: string }`
The separator used to join the scope strings when the `scope` is provided as an Array (default: `single space`).
#### sessionKey
OPTIONAL
`{ sessionKey: string }`
The key to use to store the state string when the `state` option is set to `true`. (default: 'oauth2:' + url.parse(options.authorizationURL).hostname)
#### skipUserProfile
OPTIONAL
`{ skipUserProfile: boolean }`
Whether or not to return the user profile information of the user granting authorization to their account information.
#### state
OPTIONAL
`{ state: boolean }`
When set to `true`, a state string with be created, stored, sent along with the authentication request and verified when the response from the OAuth 2.0 service is received.
#### store
OPTIONAL
`{ store: Function }`
The store to use when storing the state string (default: `SessionStore`, `req.session[sessionKey]`, requires session middleware such as `express-session`). See the [NullStore](lib/state/null.js) for an example of a store function.
## Contributing
#### Tests
The test suite is located in the `test/` directory. All new features are
expected to have corresponding test cases. Ensure that the complete test suite
passes by executing:
```bash
$ make test
```
#### Coverage
All new feature development is expected to have test coverage. Patches that
increse test coverage are happily accepted. Coverage reports can be viewed by
executing:
```bash
$ make test-cov
$ make view-cov
```
---
_Source: https://npm.io/package/@passport-next/passport-oauth2 · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._