Important: This documentation covers Yarn 1 (Classic).
For Yarn 2+ docs and migration guide, see yarnpkg.com.

Package detail

idtoken-verifier

auth0659.1kMIT2.2.4TypeScript support: included

A lightweight library to decode and verify RS JWT meant for the browser.

auth0, auth, authentication, jwt, verification, RS256, browser

readme

idtoken-verifier

A lightweight library to decode and verify RSA ID tokens meant for the browser.

Build Status NPM version Coverage License Downloads

:books: Documentation - :rocket: Getting Started - :computer: API Reference - :speech_balloon: Feedback

Documentation

Getting Started

Installation

Using npm in your project directory run the following command:

npm install idtoken-verifier

Verify an ID token

Import the library, create an instance of IdTokenVerifier and call the verify method to verify an ID token:

import IdTokenVerifier from 'idtoken-verifier';

const verifier = new IdTokenVerifier({
  issuer: 'https://my.auth0.com/',
  audience: 'gYSNlU4YC4V1YPdqq8zPQcup6rJw1Mbt'
});

verifier.verify(id_token, nonce, (error, payload) => {
  if (error) {
    // handle the error
    return;
  }

  // do something with `payload`
});

API Reference

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability Reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

What is Auth0?

<picture> <source media="(prefers-color-scheme: dark)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_dark_mode.png" width="150"> <source media="(prefers-color-scheme: light)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png" width="150"> Auth0 Logo </picture>

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?

This project is licensed under the Apache 2.0 license. See the LICENSE file for more info.

changelog

Change Log

v2.2.4 (2023-10-26)

Full Changelog

Security

v2.2.3 (2023-02-06)

Full Changelog

Changed

Security

v2.2.2 (2021-10-15)

Full Changelog

Fixed

v2.2.1 (2021-08-24)

Full Changelog

Security

v2.2.0 (2021-06-18)

Full Changelog

Added

v2.1.2 (2021-05-26)

Full Changelog

Security

v2.1.1 (2021-05-25)

Full Changelog

Fixed

Security

v2.1.0 (2020-09-11)

Full Changelog

Changed

Security

v2.0.3 (2020-04-23)

Full Changelog

Fixed

v2.0.2 (2020-02-20)

Full Changelog

Security

v2.0.1 (2020-01-10)

Full Changelog

Removed

v2.0.0 (2019-12-06)

Full Changelog

This new major version introduces more validation checks on ID tokens for OIDC conformance and as such could introduce a breaking change if you are already validating tokens that are not OIDC conformant.

In addition, methods that were marked as deprecated in v1.5.0 have now been removed. From here, always use the verify method to validate ID tokens.

Changed

Removed

Security

v1.5.1 (2019-12-06)

Full Changelog

Re-release to correct build directory error

v1.5.0 (2019-12-05)

Full Changelog

Added

  • [SDK-1166] Replaced promise-polyfill with es6-promise, applied globally #78 (stevehobbsdev)

v1.4.1 (2019-07-09)

Full Changelog

Fixed

  • Use unfetch without requiring window at load time #42 (luisrudge)

v1.4.0 (2019-06-18)

Full Changelog

Fixed

  • Validate claims after verifying the signature of the token #39 (luisrudge)

v1.3.0 (2019-06-05)

Full Changelog

Changed

v1.2.0 (2018-03-21)

Full Changelog

Added

  • Add option to set the endpoint to fetch the jwks.json file #19 (luisrudge)
  • Adding access_token validation method validateAccessToken #17 (luisrudge)

v1.1.2 (2018-03-01)

Full Changelog

Fixed

  • Fixing issue with IdTokenVerifier.getRsaVerifier #14 (dfung)

  • Use base64-js methods instead of browser globals atob and btoa #15 (maxbeatty)

v1.1.1 (2018-01-15)

Full Changelog

Changed

v1.1.0 (2017-06-15)

Full Changelog

Changed

v1.0.2 (2017-05-08)

Full Changelog

Fixed

  • FIX decode base64 string with special characters. #6 (dctoon)

v1.0.1 (2017-05-08)

Full Changelog

Fixed

  • Handle JSON.parse errors during decode #3 (rolodato)

v1.0.0 (2016-12-30)

Full Changelog

A lightweight library to decode and verify RS JWT meant for the browser.

Usage

var IdTokenVerifier = require('idtoken-verifier');

var verifier = new IdTokenVerifier({
        issuer: 'https://my.auth0.com/',
        audience: 'gYSNlU4YC4V1YPdqq8zPQcup6rJw1Mbt'
    });

verifier.verify(id_token, nonce, function(error, payload) {
    ...
});

var decoded = verifier.decode(id_token);