node-oauth

OAuth wrapper for node.js

2,438

663

2,438

170

View on GitHub View on NPM

Top Related Projects

hawk

1,905

INACTIVE - HTTP Holder-Of-Key Authentication Scheme

passport

22,849

Simple, unobtrusive authentication for Node.js.

node-openid-client

1,797

OpenID Certified™ Relying Party (OpenID Connect/OAuth 2.0 Client) implementation for Node.js.

OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid.

Quick Overview

node-oauth is a simple OAuth API for Node.js. It allows you to easily implement OAuth 1.0, 1.0A, and 2.0 on both the client and server sides. This library provides a straightforward way to integrate OAuth authentication into your Node.js applications.

Pros

Supports multiple OAuth versions (1.0, 1.0A, and 2.0)
Easy to use API for both client and server-side implementations
Well-documented with examples for various use cases
Actively maintained with regular updates

Cons

Limited built-in support for specific OAuth providers
Some users report occasional issues with certain OAuth 2.0 implementations
Documentation could be more comprehensive for advanced use cases
Lacks TypeScript support out of the box

Code Examples

Creating an OAuth 1.0A client:

const OAuth = require('oauth').OAuth;

const client = new OAuth(
  'https://api.example.com/request_token',
  'https://api.example.com/access_token',
  'your_consumer_key',
  'your_consumer_secret',
  '1.0A',
  null,
  'HMAC-SHA1'
);

Making an authenticated request with OAuth 2.0:

const OAuth2 = require('oauth').OAuth2;

const oauth2 = new OAuth2(
  'client_id',
  'client_secret',
  'https://api.example.com/',
  'authorize',
  'token',
  null
);

oauth2.get(
  'https://api.example.com/protected_resource',
  'access_token',
  function (err, result, response) {
    if (err) {
      console.error('Error:', err);
    } else {
      console.log('Result:', result);
    }
  }
);

Generating an OAuth 1.0A signature:

const OAuth = require('oauth').OAuth;

const client = new OAuth(/* ... */);

const signature = client.signUrl(
  'https://api.example.com/endpoint',
  'access_token',
  'access_token_secret',
  'GET'
);

console.log('Signed URL:', signature);

Getting Started

To use node-oauth in your project, follow these steps:

Install the package:
```
npm install oauth
```

Import the library in your code:

const OAuth = require('oauth').OAuth;
// or
const OAuth2 = require('oauth').OAuth2;

Create an OAuth client instance with your credentials and endpoints:

const client = new OAuth(
  'request_token_url',
  'access_token_url',
  'consumer_key',
  'consumer_secret',
  'version',
  'callback_url',
  'signature_method'
);

Use the client to make authenticated requests or generate signatures as needed.

For more detailed usage instructions and examples, refer to the project's documentation on GitHub.

Competitor Comparisons

hawk

1,905

INACTIVE - HTTP Holder-Of-Key Authentication Scheme

Pros of Hawk

More actively maintained with recent updates
Designed specifically for HTTP authentication, offering better security features
Provides both server and client implementations

Cons of Hawk

More complex to implement and use compared to simpler OAuth solutions
Limited to HTTP authentication, while OAuth is more versatile for various authorization scenarios

Code Comparison

Hawk example:

const Hawk = require('hawk');

const credentials = {
    id: 'dh37fgj492je',
    key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
    algorithm: 'sha256'
};

const header = Hawk.client.header('https://example.com/resource', 'GET', { credentials: credentials });

node-oauth example:

const OAuth = require('oauth').OAuth;

const oa = new OAuth(
    "https://api.twitter.com/oauth/request_token",
    "https://api.twitter.com/oauth/access_token",
    "your-consumer-key-here",
    "your-consumer-secret-here",
    "1.0A",
    "http://localhost:3000/oauth/callback",
    "HMAC-SHA1"
);

Summary

Hawk is a more modern and secure option for HTTP authentication, while node-oauth provides a broader OAuth implementation. Hawk is better suited for applications requiring strong HTTP-based security, while node-oauth is more versatile for various OAuth scenarios. The choice between the two depends on specific project requirements and the desired authentication/authorization mechanism.

passport

22,849

Simple, unobtrusive authentication for Node.js.

Pros of Passport

More comprehensive authentication solution, supporting various strategies beyond OAuth
Active development and maintenance, with regular updates and a large community
Modular architecture allowing easy integration of different authentication methods

Cons of Passport

Steeper learning curve due to its more complex architecture
Potentially overkill for simple OAuth implementations
Requires additional configuration and setup compared to node-oauth

Code Comparison

Passport (OAuth 2.0 example):

passport.use(new OAuth2Strategy({
    authorizationURL: 'https://www.example.com/oauth2/authorize',
    tokenURL: 'https://www.example.com/oauth2/token',
    clientID: EXAMPLE_CLIENT_ID,
    clientSecret: EXAMPLE_CLIENT_SECRET,
    callbackURL: "http://localhost:3000/auth/example/callback"
  },
  function(accessToken, refreshToken, profile, cb) {
    User.findOrCreate({ exampleId: profile.id }, function (err, user) {
      return cb(err, user);
    });
  }
));

node-oauth (OAuth 2.0 example):

var OAuth2 = OAuth.OAuth2;
var oauth2 = new OAuth2(
  client_id,
  client_secret,
  'https://api.example.com/',
  'oauth2/authorize',
  'oauth2/token',
  null
);
oauth2.getOAuthAccessToken(
  code,
  {grant_type: 'authorization_code', redirect_uri: 'http://localhost:3000/callback'},
  function (e, access_token, refresh_token, results){
    console.log('bearer: ',access_token);
  }
);

node-openid-client

1,797

OpenID Certified™ Relying Party (OpenID Connect/OAuth 2.0 Client) implementation for Node.js.

Pros of node-openid-client

Specifically designed for OpenID Connect, offering more comprehensive support for OIDC features
Actively maintained with regular updates and improvements
Supports modern JavaScript features and async/await syntax

Cons of node-openid-client

Steeper learning curve due to its focus on OIDC specifics
May be overkill for simple OAuth 2.0 implementations
Less flexibility for non-OIDC OAuth flows

Code Comparison

node-oauth:

const OAuth = require('oauth').OAuth;
const oauth = new OAuth(
  requestUrl, accessUrl, consumerKey, consumerSecret, '1.0', null, 'HMAC-SHA1'
);
oauth.getOAuthAccessToken(requestToken, requestTokenSecret, verifier, callback);

node-openid-client:

const { Issuer } = require('openid-client');
const issuer = await Issuer.discover('https://example.com');
const client = new issuer.Client({ client_id, client_secret });
const tokenSet = await client.callback(redirectUri, params, checks);

Summary

node-openid-client is better suited for modern OIDC implementations, offering comprehensive support and regular updates. However, it may be more complex for simple OAuth needs. node-oauth provides a more straightforward approach for basic OAuth flows but lacks specific OIDC features and active maintenance. Choose based on your project's requirements and complexity.

grant

4,075

OAuth Proxy

Pros of Grant

Supports a wider range of OAuth providers (200+)
More actively maintained with frequent updates
Simpler configuration and setup process

Cons of Grant

Less flexible for custom OAuth implementations
May have a steeper learning curve for complex scenarios
Limited to Express.js and Koa.js frameworks

Code Comparison

Grant:

const express = require('express')
const grant = require('grant').express()

express()
  .use(grant({
    defaults: {
      protocol: 'http',
      host: 'localhost:3000'
    },
    google: {
      key: 'GOOGLE_KEY',
      secret: 'GOOGLE_SECRET',
      scope: ['profile', 'email'],
      callback: '/callback'
    }
  }))

node-oauth:

const OAuth = require('oauth').OAuth2;
const oauth2 = new OAuth(
  'GOOGLE_KEY',
  'GOOGLE_SECRET',
  'https://accounts.google.com/',
  'oauth2/v1/authorize',
  'oauth2/v1/token',
  null
);

Grant offers a more concise and readable configuration, while node-oauth provides more granular control over the OAuth process. Grant's approach is generally easier for beginners, but node-oauth may be preferred for complex custom implementations.

hydra

15,439

Pros of Hydra

More comprehensive OAuth2 and OpenID Connect server implementation
Actively maintained with regular updates and security patches
Supports advanced features like JSON Web Keys (JWK) and JSON Web Tokens (JWT)

Cons of Hydra

Steeper learning curve due to its more complex architecture
Requires additional infrastructure setup (database, etc.)
May be overkill for simple OAuth implementations

Code Comparison

Hydra (Go):

import "github.com/ory/hydra/client"

c := client.NewHTTPClientWithConfig(nil, &client.TransportConfig{
    Schemes:  []string{"http", "https"},
    Host:     "localhost:4444",
    BasePath: "/",
})

node-oauth (JavaScript):

var OAuth = require('oauth').OAuth;

var oa = new OAuth(
  "https://api.twitter.com/oauth/request_token",
  "https://api.twitter.com/oauth/access_token",
  "your-consumer-key",
  "your-consumer-secret",
  "1.0A",
  "http://localhost:3000/oauth/callback",
  "HMAC-SHA1"
);

Summary

Hydra is a more feature-rich and actively maintained OAuth2 server, suitable for complex enterprise applications. node-oauth is simpler and easier to integrate for basic OAuth functionality, particularly in Node.js projects. The choice between them depends on the specific requirements of your project and the level of OAuth complexity you need to handle.

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

node-oauth

A simple oauth API for node.js . This API allows users to authenticate against OAUTH providers, and thus act as OAuth consumers. It also has support for OAuth Echo, which is used for communicating with 3rd party media providers such as TwitPic and yFrog.

Tested against Twitter (http://twitter.com), term.ie (http://term.ie/oauth/example/), TwitPic, and Yahoo!

Also provides rudimentary OAuth2 support, tested against facebook, github, foursquare, google and Janrain. For more complete usage examples please take a look at connect-auth (http://github.com/ciaranj/connect-auth)

[][koding] [koding]: https://koding.com/Teamwork?import=https://github.com/ciaranj/node-oauth/archive/master.zip&c=git1 [ Pair on Thinkful ][Thinkful] [Thinkful]: http://start.thinkful.com/node/?utm_source=github&utm_medium=badge&utm_campaign=node-oauth

Installation

$ npm install oauth

Examples

To run examples/tests install Mocha $ npm install -g mocha and run $ mocha you-file-name.js:

OAuth1.0

describe('OAuth1.0',function(){
  var OAuth = require('oauth');

  it('tests trends Twitter API v1.1',function(done){
    var oauth = new OAuth.OAuth(
      'https://api.twitter.com/oauth/request_token',
      'https://api.twitter.com/oauth/access_token',
      'your application consumer key',
      'your application secret',
      '1.0A',
      null,
      'HMAC-SHA1'
    );
    oauth.get(
      'https://api.twitter.com/1.1/trends/place.json?id=23424977',
      'your user token for this app', //test user token
      'your user secret for this app', //test user secret            
      function (e, data, res){
        if (e) console.error(e);        
        console.log(require('util').inspect(data));
        done();      
      });    
  });
});

OAuth2.0

describe('OAuth2',function(){
  var OAuth = require('oauth');

   it('gets bearer token', function(done){
     var OAuth2 = OAuth.OAuth2;    
     var twitterConsumerKey = 'your key';
     var twitterConsumerSecret = 'your secret';
     var oauth2 = new OAuth2(server.config.keys.twitter.consumerKey,
       twitterConsumerSecret, 
       'https://api.twitter.com/', 
       null,
       'oauth2/token', 
       null);
     oauth2.getOAuthAccessToken(
       '',
       {'grant_type':'client_credentials'},
       function (e, access_token, refresh_token, results){
       console.log('bearer: ',access_token);
       done();
     });
   });

Change History

0.10.0
- OAuth2: No longer allows repeated callbacks 'on error' to propagate to calling code (googleapi often did this apparently)
0.9.15
- OAuth2: Allow specification of agent
0.9.14
- OAuth2: Extend 'successful' token responses to include anything in the 2xx range.
0.9.13
- OAuth2: Fixes the "createCredentials() is deprecated, use tls.createSecureContext instead" message. (thank you AJ ONeal)
0.9.12
- OAuth1/2: Can now pass Buffer instance directly for PUTs+POSTs (thank you Evan Prodromou)
- OAuth1: Improve interoperability with libraries that mess with the prototype. (thank you Jose Ignacio Andres)
- OAuth2: Adds PUT support for OAuth2 (thank you Derek Brooks)
- OAuth1: Improves use_strict compatibility (thank you Ted Goddard)
0.9.11
- OAuth2: No longer sends the type=webserver argument with the OAuth2 requests (thank you bendiy)
- OAuth2: Provides a default (and overrideable) User-Agent header (thanks to Andrew Martens & Daniel Mahlow)
- OAuth1: New followRedirects client option (true by default) (thanks to Pieter Joost van de Sande)
- OAuth1: Adds RSA-SHA1 support (thanks to Jeffrey D. Van Alstine & Michael Garvin & Andreas Knecht)
0.9.9
- OAuth1: Fix the mismatch between the output of querystring.stringify() and this._encodeData(). (thank you rolandboon)
- OAuth2: Adds Authorization Header and supports extra headers by default ( thanks to Brian Park)
0.9.8
- OAuth1: Support overly-strict OAuth server's that require whitespace separating the Authorization Header parameters (e.g. 500px.com) (Thanks to Christian Schwarz)
- OAuth1: Fix incorrect double-encoding of PLAINTEXT OAuth connections (Thanks to Joe Rozner)
- OAuth1: Minor safety check added when checking hostnames. (Thanks to Garrick Cheung)
0.9.7
- OAuth2: Pass back any extra response data for calls to getOAuthAccessToken (Thanks to Tang Bo Hao)
- OAuth2: Don't force a https request if given a http url (Thanks to Damien Mathieu)
- OAuth2: Supports specifying a grant-type of 'refresh-token' (Thanks to Luke Baker)
0.9.6
- OAuth2: Support for 302 redirects (Thanks Patrick Negri).
- OAuth1/2: Some code tidying. ( Thanks to Raoul Millais )
0.9.5
- OAuth1: Allow usage of HTTP verbs other than GET for retrieving the access and request tokens (Thanks to Raoul Millais)
0.9.4
- OAuth1/2: Support for OAuth providers that drop connections (don't send response lengths? [Google])
- OAuth2: Change getOAuthAccessToken to POST rather than GET ( Possible Breaking change!!! ... re-tested against Google, Github, Facebook, FourSquare and Janrain and seems ok .. is closer to the spec (v20) )
0.9.3
- OAuth1: Adds support for following 301 redirects (Thanks bdickason)
0.9.2
- OAuth1: Correct content length calculated for non-ascii post bodies (Thanks selead)
- OAuth1: Allowed for configuration of the 'access token' name used when requesting protected resources (OAuth2)
0.9.1
- OAuth1: Added support for automatically following 302 redirects (Thanks neyric)
- OAuth1: Added support for OAuth Echo (Thanks Ryan LeFevre).
- OAuth1: Improved handling of 2xx responses (Thanks Neil Mansilla).
0.9.0
- OAuth1/2: Compatibility fixes to bring node-oauth up to speed with node.js 0.4x [thanks to Rasmus Andersson for starting the work ]
0.8.4
- OAuth1: Fixed issue #14 (Parameter ordering ignored encodings).
- OAuth1: Added support for repeated parameter names.
- OAuth1/2: Implements issue #15 (Use native SHA1 if available, 10x speed improvement!).
- OAuth2: Fixed issue #16 (Should use POST when requesting access tokens.).
- OAuth2: Fixed Issue #17 (OAuth2 spec compliance).
- OAuth1: Implemented enhancement #13 (Adds support for PUT & DELETE http verbs).
- OAuth1: Fixes issue #18 (Complex/Composite url arguments [thanks novemberborn])
0.8.3
- OAuth1: Fixed an issue where the auth header code depended on the Array's toString method (Yohei Sasaki) Updated the getOAuthRequestToken method so we can access google's OAuth secured methods. Also re-implemented and fleshed out the test suite.
0.8.2
- OAuth1: The request returning methods will now write the POST body if provided (Chris Anderson), the code responsible for manipulating the headers is a bit safe now when working with other code (Paul McKellar)
- Package: Tweaked the package.json to use index.js instead of main.js
0.8.1
- OAuth1: Added mechanism to get hold of a signed Node Request object, ready for attaching response listeners etc. (Perfect for streaming APIs)
0.8.0
- OAuth1: Standardised method capitalisation, the old getOauthAccessToken is now getOAuthAccessToken (Breaking change to existing code)
0.7.7
- OAuth1: Looks like non oauth_ parameters where appearing within the Authorization headers, which I believe to be incorrect.
0.7.6
- OAuth1: Added in oauth_verifier property to getAccessToken required for 1.0A
0.7.5
- Package: Added in a main.js to simplify the require'ing of OAuth
0.7.4
- OAuth1: Minor change to add an error listener to the OAuth client (thanks troyk)
0.7.3
- OAuth2: Now sends a Content-Length Http header to keep nginx happy :)
0.7.2
- OAuth1: Fixes some broken unit tests!
0.7.0
- OAuth1/2: Introduces support for HTTPS end points and callback URLS for OAuth 1.0A and Oauth 2 (Please be aware that this was a breaking change to the constructor arguments order)

Contributors (In no particular order)

Evan Prodromou
Jose Ignacio Andres
Ted Goddard
Derek Brooks
Ciaran Jessup - ciaranj@gmail.com
Mark Wubben - http://equalmedia.com/
Ryan LeFevre - http://meltingice.net
Raoul Millais
Patrick Negri - http://github.com/pnegri
Tang Bo Hao - http://github.com/btspoony
Damien Mathieu - http://42.dmathieu.com
Luke Baker - http://github.com/lukebaker
Christian Schwarz - http://github.com/chrischw/
Joe Rozer - http://www.deadbytes.net
Garrick Cheung - http://www.garrickcheung.com/
rolandboon - http://rolandboon.com
Brian Park - http://github.com/yaru22
bendiy - https://github.com/bendiy
Andrew Martins - http://www.andrewmartens.com
Daniel Mahlow - https://github.com/dmahlow
Pieter Joost van de Sande - https://github.com/pjvds
Jeffrey D. Van Alstine
Michael Garvin
Andreas Knecht
AJ ONeal
Philip Skinner - https://github.com/PhilipSkinner
Tom Ciborski - https://ciborski.com/

Top Related Projects

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

Top Related Projects

Quick Overview

Pros

Cons

Code Examples

Getting Started

Competitor Comparisons

Pros of Hawk

Cons of Hawk

Code Comparison

Summary

Pros of Passport

Cons of Passport

Code Comparison

Pros of node-openid-client

Cons of node-openid-client

Code Comparison

Summary

Pros of Grant

Cons of Grant

Code Comparison

Pros of Hydra

Cons of Hydra

Code Comparison

Summary

Convert designs to code with AI

README

node-oauth

Installation

Examples

OAuth1.0

OAuth2.0

Change History

Contributors (In no particular order)

Top Related Projects

Convert designs to code with AI

NPM DownloadsLast 30 Days